DarkSword iOS exploit still steals crypto wallets via Coruna malware

Censys researchers warn that the DarkSword exploit is still used with Coruna malware to steal cryptocurrency wallet data on iOS. The flaws were patched in iOS 26.3, but devices on iOS 26, iOS 18 and older remain vulnerable.

• DarkSword targets WebKit and JavaScriptCore; Coruna steals wallet data
• Targeted apps include Bitpie, Coinbase, Exodus, MetaMask and Trust Wallet
• The exploit also mines Photos and Notes for BIP39 recovery phrases
• Flaws were fixed in iOS 26.3; current version is iOS 27.0.1