Security researchers at SlowMist have issued warnings that attackers may have adapted the Darksword exploit chain to compromise devices running iOS 26.5, putting crypto wallet private keys and other iPhone data at risk. According to SlowMist Chief Information Security Officer 23pds, attackers are using Darksword to bypass Apple's security controls, gain extensive access to affected iPhones, and collect data from locally installed cryptocurrency wallets. The reported iOS 26.5 exposure has not been independently confirmed by Apple or Google, but SlowMist claims attackers have modified the tool to work against the newer operating system. Google's Threat Intelligence Group previously identified Darksword as a full iOS exploit chain that combines six vulnerabilities, with documented activity from at least December 2025 through March 2026.
Binance has issued urgent warnings to iPhone and iPad users after security researchers discovered FomoPeek versions 1.1 and 1.2 contained malicious code capable of accessing private keys, seed phrases, and other sensitive data. According to Binance, the malware could exploit iOS vulnerabilities to obtain high-level device privileges, exposing information from other apps including login credentials, chat records, and locally stored files alongside cryptocurrency wallet data. Affected users were advised to create new wallets on clean devices and transfer assets to new addresses, with Binance recommending users avoid reinstalling the application and update to the latest iOS version. Researchers examining the app found a kernel exploitation framework with eight attack methods and declared support covering iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1.
AI technology is increasingly being used by cybercriminals to build more convincing fraudulent pages, as demonstrated by recent developments in antivirus renewal scams. According to Malwarebytes, scammers are now using AI-generated code to create sophisticated fake antivirus renewal pages that can bypass traditional warning signs. The technology allows criminals to produce professional-looking pages with fluent copy and polished layouts, making it easier to copy real logos and create convincing fraudulent websites. This evolution represents a significant shift from the traditional approach of looking for mistakes, bad grammar, or clumsy layouts to identify fraudulent pages.
The Darksword attacks typically begin when an iPhone user opens a malicious link in Safari, with attackers using social engineering to initiate the compromise through social networks, messaging apps, or other communication channels. According to Google's research, the original framework supported iOS 18.4 through iOS 18.7, with one flaw tracked as CVE-2025-43529 affecting JavaScriptCore in Safari. SlowMist reports that once the chain succeeds, attackers may obtain root-level control that can remove isolation barriers, placing private keys and wallet records at risk. The malicious payloads can collect account details, messages, browser records, files, location history, saved Wi-Fi data, and information linked to cryptocurrency wallets, with Google associating some activity with commercial surveillance providers and suspected state-linked groups.
The stolen password and wallet identifying information could allow criminals to access victims' crypto holdings, with no confirmed victim total or stolen cryptocurrency amount reported in the latest warnings. However, recent legal developments show the financial impact of such threats, as three U.S. investors filed a federal lawsuit alleging fake applications impersonating Sparrow Wallet appeared in Apple's App Store and caused approximately $1.835 million in Bitcoin losses. Another counterfeit application posing as Ledger Live allegedly stole at least $9.5 million from more than 50 victims between April 7-13, with funds traced to over 150 KuCoin deposit addresses. SlowMist advises users to install mobile operating system updates promptly and avoid opening unsolicited links from strangers, while Google and Apple have treated current software as central defense against such threats.
