A recent wave of cyberattacks on iPhone users in Ukraine has been attributed to a new virus called DarkSword. The malware, which is believed to be linked to Russian intelligence services, uses up to six zero-day vulnerabilities to compromise devices and steal personal data.
Researchers from Google, iVerify, and Lookout have identified the DarkSword tool, which supports iOS versions 18.4-18.7 and installs malicious modules GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The attacks are carried out via compromised Ukrainian websites, also known as watering hole campaigns.
The emergence of DarkSword highlights the growing availability of high-end spyware and the increasing risks for crypto investors. As mobile wallets and DeFi platforms become more popular, the potential for financial losses increases. Experts stress that there is still no direct evidence of active cryptocurrency theft, but the technical capability is built into the tool.