DarkSword Malware Platform Targeted iOS Wallet Apps
Researchers uncovered a commercial toolkit exploiting iOS vulnerabilities to steal cryptocurrency recovery phrases.
Updated on Oct. 9, 2026 in Cybersecurity
Live Poll
Do you trust mobile apps to secure your financial recovery phrases against potential malware exploits?
In September 2026, security researchers identified the DarkSword platform, a commercial service that used the Coruna malware to extract BIP39 recovery phrases from iPhone users. The platform targeted 18 distinct cryptocurrency wallet applications by exploiting iOS kernel-level vulnerabilities.
Why it matters
This development highlights the emergence of sophisticated, commercialized mobile malware-as-a-service, where operators leverage agent networks and commission-based structures to automate the theft of sensitive digital assets. It demonstrates how attackers are increasingly targeting the local storage of mobile devices to bypass primary security defenses.
The DarkSword infrastructure managed 18 wallet-specific modules and allowed up to 60 control commands, with theft modules checking for target wallet launches at maximum intervals of 3 seconds. The malware used a shared AES encryption key and disabled TLS certificate checks to bypass secure communication protocols.
The players
Censys
An internet intelligence firm that maintains a comprehensive database of connected devices and infrastructure mapping.
Tencent
A major technology conglomerate providing cloud and hosting services where infection samples were linked.
The details
The DarkSword platform utilizes browser-based exploits targeting WebKit—Apple's browser engine—and JavaScriptCore to break out of the browser sandbox, allowing it to achieve unauthorized kernel access. Once established, a coordinator service named SpringBoard monitors the device for specific wallet applications and injects theft modules to scan photos and Apple Notes for BIP39 recovery phrases. The malware also bypasses standard security measures by disabling Transport Layer Security (TLS) certificate checks, which are protocols designed to authenticate and encrypt data transfers.
Timeline
September 6, 2026: Two iPhones running iOS 16.1 and 16.3.1 accessed a beacon page.
September 15-17, 2026: Researchers identified exposed production server infrastructure.
October 7, 2026: Censys published a report detailing the DarkSword infrastructure.
The Tech Race
The DarkSword platform represents a transition toward commercialized, service-oriented mobile exploitation that mimics enterprise software-as-a-service models. This shift toward modular theft-as-a-service architectures creates a persistent threat landscape that outpaces traditional, manual-injection mobile malware methods.
Users can mitigate these risks by avoiding the storage of unencrypted BIP39 recovery phrases in photos or notes applications on their mobile devices. Because the malware relies on kernel-level browser exploits, users are encouraged to maintain updated operating systems to minimize the surface area for such sandbox breakouts.
The takeaway
The move toward automated wallet-theft modules marks a significant shift in mobile criminal efficiency, forcing users to treat local device storage as a high-risk vector. Watch for future research identifying further infrastructure samples linked to the Shenyang-based hosting systems to determine if these modules are updated for newer iOS versions.
Further reading
For broader trends in mobile security and threat analysis, visit Cybersecurity.
Live Poll
Do you trust mobile apps to secure your financial recovery phrases against potential malware exploits?
