DarkSword Exploit Platform Targets iPhones to Steal Crypto Wallets

• •DarkSword uses Coruna malware to exploit iPhones and steal crypto wallet secrets.
• •Exposed servers revealed 11 victim recovery phrases and 179 loot directories.
• •The operation is characterized as a commercial exploitation-as-a-service.

Exposed DarkSword servers have revealed a sophisticated platform using Coruna malware to compromise iPhones and steal cryptocurrency wallet recovery phrases. Censys researchers found operational telemetry, wallet injection modules, and records of stolen data, including 11 victim recovery phrases and 179 device loot directories. The platform employs a command-and-control infrastructure that registers devices and queues commands for exfiltration. Was observed, with telemetry showing infected iPhones polling a beacon every three seconds. The malware targets popular wallet applications such as MetaMask and Coinbase, injecting theft modules into their processes. While the exact number of unique victims remains unclear, evidence of theft has been documented. The operation appears to function as a commercial exploitation service, though no specific threat actor has been identified.