DarkSword iPhone Hack Steals Crypto Seed Phrases via iOS Flaw

Security firm Censys discovered a hacking tool called DarkSword that targets iPhones to steal cryptocurrency wallet recovery phrases. The software scans the Photos and Notes apps for seed phrases consisting of 12 or 24 words. Researchers found eleven stolen recovery phrases on an attacker server, including wallets for TronLink, Bitget, Trust Wallet, Phantom, and imToken.

DarkSword exploits leaks in WebKit, the engine behind Safari and other iPhone browsers. Visiting an infected webpage is enough to infect a device, as long as the malicious tab remains open. The version examined by Censys used a Chinese-language lure page, and the kit is rented as a service to other criminals with a list of 75 customer accounts.

The tool includes separate modules for eighteen wallet applications, such as Coinbase, MetaMask, Exodus, and Uniswap. Apple patched all exploited vulnerabilities in iOS 26.3. Censys identified five servers still distributing the kit in October.

Separately, Binance warned Apple users about a dangerous iOS vulnerability called worse_query. The flaw allows malicious applications to access files normally isolated inside other apps, threatening seed phrases, private keys, and login credentials.

Binance says the issue affects iOS itself rather than its own wallet infrastructure. The vulnerability impacts iOS 26.7.1, 27.0.1, and 27.2, and researchers describe it as a sandbox escape affecting iOS 26 and iOS 27.

Users who suspect compromise should create new wallets on clean devices and move their funds. Binance also recommends resetting active login sessions and updating installed software. Censys could not determine who is behind DarkSword.