Main takeaway: protect crypto wallets by keeping iOS updated, enabling Lockdown Mode if you can’t update, avoiding suspicious crypto links, and if a compromise occurs, generate a new wallet on a secure device and move funds promptly.

If you may have been exposed, create a new wallet on a clean, updated device and transfer funds, avoiding reuse of any exposed seed phrases.

Mazrael warns to immediately update devices, skip suspicious links, and not reuse exposed seed phrases; if compromised, transfer funds to a new wallet on a secure device.

The advisory points to a broad set of potential targets across regions including Saudi Arabia, Turkey, Malaysia, and Ukraine, indicating wide reach and sophistication.

DarkSword is a spyware tool designed to exfiltrate cryptocurrency wallet data, device keychains, messages, photos and passwords, used in targeted attacks by spyware vendors and suspected state actors, with potential for broader use.

Google warns that other attackers may be leveraging DarkSword, which has been linked to spyware tools and targeted attacks.

There is concern that the wider internet infrastructure distributing the malicious code handles around 135 million visits per month, suggesting a potential for expanding attacks if new vulnerabilities are found.

Attacks may adapt older code to newer iOS versions using AI, though most attempts have not succeeded; current tools could still evolve.

Disclaimer: this report does not constitute investment advice.

Researchers note DarkSword exploits six previously identified Google vulnerabilities, which Apple patched in updates, but new undiscovered flaws could allow re-use of the malware.

As Binance resumes withdrawals in phases, the crypto community remains cautious about scammers exploiting the update period through impersonation and phishing, with Binance reiterating it will never initiate contact or request fees for withdrawals.

In the wake of Binance withdrawals, scammers may impersonate the exchange to pressure users into faster withdrawals or other exploits; users should stay vigilant for social-engineering attempts.