DarkSword Malware Is Used in Attacks Affecting Some iOS 26 Versions

DarkSword-PROV2 is being used in attacks that can expose crypto wallet data on iPhones running iOS 26.0 through 26.1. Code analysis identified exploitable versions from iOS 18.6 through 18.7.2 and iOS 26.0 through 26.1. The toolkit advertises support for iOS 13 and newer, but the analyzed exploit paths covered those specific ranges. DarkSword-PROV2 appeared on GitHub in July 2026, and related attack infrastructure was found in use in late September. The toolkit combines exploit delivery with device and data collection, information theft and fund collection.

Source: TokenPost