CertiK attributes the intrusion path to six linked iOS flaws that may expose crypto credentials and personal information on unpatched iPhones, according to a Nov. 6 warning from the security firm.
The firm's account identifies a harmful Safari page as the entry point; a phone owner does not need to use a wallet, authorize a transaction or download a file.
CertiK says the exploit strings together six iOS flaws, bypassing safeguards so software on the phone can collect data. The material potentially exposed includes wallet private keys and recovery phrases, iPhone Keychain passwords, photos and notes; CertiK also lists MetaMask, Trust Wallet, Phantom, Exodus and Coinbase Wallet as mobile apps that may be affected.
The iOS ranges partly overlap with an earlier EconoTimes code analysis of DarkSword-PROV2 paths. It identified routes for versions 18.6 through 18.7.2 and 26.0 through 26.1; the package's stated reach started at iOS 13.
CertiK recommends installing the latest iOS update and keeping recovery phrases out of screenshots, Notes and cloud storage. It also suggests Lockdown Mode for people facing targeted attacks.
