DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases

Cybersecuritynews •Tushar Subhra Dutta • October 8, 2026

DarkSword operators are using Coruna malware to steal cryptocurrency wallet recovery phrases from iPhones, turning browser exploits into a ready-to-use theft service. Exposed server directories revealed wallet modules, command systems, and records of stolen data, giving researchers a closer look at how the platform works beyond its initial exploit chain. A copy of one production […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

P7 DarkSword Malware Targets iPhones for Crypto Wallet Theft Researchers have identified a new variant of the DarkSword malware, named P7 DarkSword, which targets unpatched iPhones to steal sensitive information, including cryptocurrency wallet data. Discovered by iVerify, the malware was found on a financial institution employee's device in August 2026. P7 DarkSword enhances its stealth capabilities by reducing activity logs and directly extracting Keychain data on the device. It communicates with its command-and-control server every 15 seconds to receive instructions, allowing it to upload files, access photos, and scan for installed apps. The malware exploits vulnerabilities in iOS versions 18.4 to 18.7, and Apple has issued updates to protect users. P7 DarkSword is distributed through malicious ads and watering-hole attacks, posing a significant risk to users who delay updates. The exact number of affected devices remains unclear. 24 sources 68

Extracted Entities

DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)