A code analysis found that DarkSword-PROV2 may expose cryptocurrency wallet information on iPhones in two specific iOS ranges, raising security concerns for affected users.
In the code, exploitable routes were identified for iOS versions 18.6 through 18.7.2 and 26.0 through 26.1. The package’s stated reach begins at iOS 13, beyond the version ranges detailed in the analysis.
The project’s appearance on GitHub dates to July 2026, with associated attack infrastructure observed in operation in late September.
The toolkit pairs exploit delivery with access to device information. It can gather messages, files, Apple Keychain entries and cryptocurrency wallet data; other functions can decrypt wallet information and consolidate funds.
A malicious page viewed through Safari could be enough to initiate an attack. Recommended precautions include updating iOS and avoiding untrusted links.
People who opened a questionable site should treat any seed phrases or private keys on the phone as potentially exposed. Guidance calls for setting up a replacement wallet using a separate device with no prior access to the page, moving assets into it, then reviewing blockchain activity and granted token approvals.
