A new iOS threat dubbed DarkSword is specifically targeting cryptocurrency users on iPhone, employing targeted attacks to steal wallet private keys and sensitive data. The malware leverages iOS vulnerabilities to break out of the sandbox environment, accessing Keychain-stored passwords, local wallet key files, and other private information including Notes app contents. The attack chain involves poisoning legitimate apps available through the App Store — notably an app called FomoPeek — which then deploys the DarkSword payload on victim devices. Security researchers have published detailed analyses of both the DarkSword command-and-control infrastructure and the underlying iOS kernel exploitation techniques used in the campaign. Users are urged to update their iPhone and iPad systems immediately to patch exploited vulnerabilities.