🚨 One webpage in Safari is all it takes: iPhone wallets are being targeted
Group: 邀请您加入我的群组 悟空粉丝群
CertiK issued a warning on November 6: attackers are using a new version of the DarkSword iOS exploit kit, specifically targeting crypto wallets on unpatched iPhones.
The most important point: you don’t need to connect your wallet or sign anything. Simply opening a malicious page in Safari could be enough to get compromised.
The apps being targeted include MetaMask, Trust Wallet, Phantom, Exodus, and Coinbase. Passwords and seed phrases stored on your phone are also on the target list.
The trail goes back further: Google’s research on March 18 documented an attack chain affecting iOS 18.4 through 18.7. It used a combination of six vulnerabilities to take over devices, then deployed three malware families: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. GHOSTBLADE collects wallet data, Keychain contents, message history, and photos.
The good news is that all these vulnerabilities have been fixed by iOS 26.3, with most patched earlier. The bad news is that the P7 variant checks for commands every 15 seconds and can also identify which wallets are installed on the phone.
What’s really worth noting is that the threat model has changed: it used to be “what did you sign?” Now it’s “what did you click?”
Which system version is your phone running now? Let us know in the comments 👇
One-line advice: Update your system first, then think about a cold wallet.
Tap the profile picture to watch the livestream + join my fan group for daily strategies 🚀
#加密安全 #比特币 #wallet
Group: 邀请您加入我的群组 悟空粉丝群
CertiK issued a warning on November 6: attackers are using a new version of the DarkSword iOS exploit kit, specifically targeting crypto wallets on unpatched iPhones.
The most important point: you don’t need to connect your wallet or sign anything. Simply opening a malicious page in Safari could be enough to get compromised.
The apps being targeted include MetaMask, Trust Wallet, Phantom, Exodus, and Coinbase. Passwords and seed phrases stored on your phone are also on the target list.
The trail goes back further: Google’s research on March 18 documented an attack chain affecting iOS 18.4 through 18.7. It used a combination of six vulnerabilities to take over devices, then deployed three malware families: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. GHOSTBLADE collects wallet data, Keychain contents, message history, and photos.
The good news is that all these vulnerabilities have been fixed by iOS 26.3, with most patched earlier. The bad news is that the P7 variant checks for commands every 15 seconds and can also identify which wallets are installed on the phone.
What’s really worth noting is that the threat model has changed: it used to be “what did you sign?” Now it’s “what did you click?”
Which system version is your phone running now? Let us know in the comments 👇
One-line advice: Update your system first, then think about a cold wallet.
Tap the profile picture to watch the livestream + join my fan group for daily strategies 🚀
#加密安全 #比特币 #wallet
