Google's Threat Intelligence Group has identified a sophisticated iOS exploit chain, dubbed DarkSword, targeting cryptocurrency wallets. The exploit, active since November 2025, leverages six vulnerabilities, including zero-days, to compromise devices running iOS versions 18.4 to 18.7. DarkSword has been used by commercial surveillance vendors and suspected state-backed actors in Saudi Arabia, Turkey, Malaysia, and Ukraine. The exploit allows attackers to deploy malware capable of stealing communication logs, location history, browser data, and cryptocurrency wallet information. It can also record audio, take screenshots, and execute backdoor commands. Google reported these vulnerabilities to Apple, which has since patched them in iOS 26.3. Users are urged to update their devices immediately to protect against these threats.