Odaily Planet Daily reports that, according to monitoring by multiple security researchers and KOLs, the iOS exploit toolkit DarkSword takes advantage of a vulnerability in the underlying iOS 18 system. After users visit an infected website using Safari, malicious code can run in the background on their phones without requiring them to connect a wallet or authorize a signature. Attackers can use it to steal passwords, photos, files, and the private keys and seed phrases of crypto wallets. At least 18 malicious websites have been identified so far, with victims losing as much as $5.57 million across more than 20 wallets. Changpeng Zhao urged users to update their iOS systems promptly, especially those who have not updated in a long time. He said that no wallet software can update a user’s operating system on their behalf; self-custody means users are responsible for doing so themselves.