DarkSword Exploit Kit Targets iPhones, Steals Crypto Wallet and Personal Data   A newly identified exploit kit named “DarkSword” is being used to target iOS devices and extract a wide range of sensitive user information, including data from cryptocurrency wallet applications. The threat specifically impacts iPhones running iOS versions 18.4 to 18.7 and has been linked to multiple threat actors. Among them is UNC6353, believed to have Russian origins, which leveraged the previously disclosed Coruna exploit chain earlier this month. The exploit kit was uncovered by researchers at mobile security firm Lookout during an investigation into infrastructure tied to Coruna-based attacks. The analysis was further supported by Google’s Threat Intelligence Group (GTIG) and iVerify, providing deeper insights into this emerging threat and the groups behind it. According to iVerify, the exploit chain relies on already known vulnerabilities—covering sandbox escape, privilege escalation, and remote code execution—that have since been patched by Apple in recent iOS updates. DarkSword operates using six vulnerabilities tracked as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. According to a report from GTIG, the exploit kit has been active since at least November 2025 and has been deployed by several actors using three distinct malware families: * GHOSTBLADE: A JavaScript-based data stealer that collects extensive information such as cryptocurrency wallet details, system data, browsing history, photos, location, and communications from platforms like iMessage, Telegram, WhatsApp, email, and call logs. * GHOSTKNIFE: A backdoor capable of extracting account credentials, messages, browsing data, location history, and recordings. * GHOSTSABER: Another JavaScript-based backdoor that can enumerate devices and accounts, execute scripts, access files, and steal data. The earliest observed use of this exploit chain is attributed to UNC6748, which targeted users in Saudi Arabia through a website mimicking Snapchat. GTIG also reported that in late November 2025, DarkSword activity was detected in Turkey and linked to PARS Defense, a commercial surveillance vendor. These attacks targeted devices running iOS 18.4 through 18.7. "Unlike the UNC6748 activity, this campaign was carried out with more attention to OPSEC, with obfuscation applied to the exploit loader and some of the exploit stages, and the use of ECDH and AES to encrypt exploits between the server and the victim," GTIG notes. Subsequently, Google researchers observed similar activity in Malaysia, where another PARS Defense client deployed the GHOSTSABER backdoor. UNC6353, suspected to be involved in Russian espionage operations, has been using the Coruna exploit kit since mid-2025 and began deploying DarkSword in December 2025 against targets in Ukraine. These attacks continued into March 2026, primarily through watering hole campaigns involving compromised websites that delivered the GHOSTBLADE malware. Researchers also noted that although "earlier DarkSword use attributed to UNC6748 and PARS Defense also supported iOS 18.7, we did not observe that from UNC6353, despite their later operational timeline." Lookout researchers highlighted that both Coruna and DarkSword show signs of development aided by large language models (LLMs), with DarkSword containing multiple explanatory code comments. “This malware is highly sophisticated and appears to be a professionally designed platform enabling rapid development of modules through access to a high level programming language,” Lookout says. “This extra step shows a significant effort put into the development of this malware with thoughts about maintainability, long-term development and extensibility.” In addition to the one-click exploit kit, iVerify identified a Safari-based exploit chain involving sandbox escape, privilege escalation, and in-memory implants capable of extracting sensitive data. DarkSword attacks typically begin in the Safari browser, where multiple exploits are chained together to gain kernel-level read/write access. A central orchestrator component (pe_main.js) is then used to execute malicious code. While the initial compromise vector remains unclear, attackers were able to inject malicious iframes into targeted websites. The orchestrator then embeds a JavaScript engine into high-privilege iOS services such as App Access, Wi-Fi, Springboard, Keychain, and iCloud, enabling data exfiltration via modules like GHOSTBLADE. The stolen data may include: * Saved passwords * Photos (including hidden and screenshots) * Messaging app databases (WhatsApp, Telegram) * Cryptocurrency wallets (Coinbase, Binance, Ledger, etc.) * SMS messages * Contacts and call history * Location and browsing history * Cookies and Wi-Fi credentials * Apple Health data * Calendar entries and notes * Installed apps and linked accounts Notably, the malware deletes temporary files and exits after exfiltration, suggesting it is not designed for persistent surveillance. Lookout assesses that DarkSword is likely used by a Russian-linked threat actor pursuing both financial gain and espionage objectives aligned with national intelligence interests. Users are strongly advised to update their devices to the latest iOS version. Devices with Lockdown Mode enabled are also protected against both Coruna and DarkSword. In a statement to BleepingComputer, Apple confirmed that patches addressing these vulnerabilities were released last year and extended to older devices as well. The company noted that users running iOS 15 through iOS 26 are already protected, and that devices on iOS 17 and later benefit from the Memory Integrity Enforcement feature, which mitigates such attacks. To enhance security, users should enable passcodes, use strong passwords with two-factor authentication, avoid sideloading apps, and refrain from clicking on suspicious links or attachments.

DarkSword Exploit Kit Targets iPhones, Steals Crypto Wallet and Personal Data #CryptoWalletTheft #DarkSwordexploitkit #GHOSTBLADE

Trezor and Ledger Impersonated in Physical QR Code Phishing Scam Targeting Crypto Wallet Users  Nowadays criminals push fake crypto warnings through paper mail, copying real product packaging from firms like Trezor and Ledger. These printed notes arrive at homes without digital traces, making them feel more trustworthy than email scams. Instead of online messages, fraudsters now use stamps and envelopes to mimic official communication. Because it comes in an envelope, people may believe the request is genuine. Through these letters, attackers aim to steal secret backup codes used to restore wallets. Physical delivery gives the illusion of authenticity, even though the goal remains theft. The method shifts away from screens but keeps the same deceitful intent.  Pretending to come from company security units, these fake messages tell recipients they need to finish an urgent "Verification Step" or risk being locked out of their wallets. A countdown appears on screen, pushing people to act fast - slowing down feels risky when time runs short. Opening the link means scanning a barcode first, then moving through steps laid out by the site. Pressure builds because delays supposedly lead to immediate consequences. Following directions seems logical under such conditions, especially if trust in the sender feels justified.  A single message pretending to come from Trezor told users about an upcoming Authentication Check required before February 15, 2026, otherwise access to Trezor Suite could be interrupted. In much the same way, another forged notice aimed at Ledger customers claimed a Transaction Check would turn mandatory, with reduced features expected after October 15, 2025, unless acted upon. Each of these deceptive messages leads people to fake sites designed to look nearly identical to real setup portals. BleepingComputer’s coverage shows the QR codes redirect to websites mimicking real company systems.  Instead of clear guidance, these fake sites display alerts - claiming accounts may be limited, transactions could fail, or upgrades might stall without immediate action. One warning follows another, each more urgent than the last, pulling users deeper into the trap. Gradually, they reach a point where entering their crypto wallet recovery words seems like the only option left. Fake websites prompt people to type in their 12-, 20-, or 24-word recovery codes, claiming it's needed to confirm device control and turn on protection.  Though entered privately, those words get sent straight to servers run by criminals. Because these attackers now hold the key, they rebuild the digital wallet elsewhere without delay. Money vanishes quickly after replication occurs. Fewer scammers send fake crypto offers by post, even though email tricks happen daily. Still, real-world fraud attempts using paper mail have appeared before.  At times, crooks shipped altered hardware wallets meant to steal recovery words at first use. This latest effort shows hackers still test physical channels, especially if past leaks handed them home addresses. Even after past leaks at both Trezor and Ledger revealed user emails, there's no proof those events triggered this specific attack. However the hackers found their targets, one truth holds - your recovery phrase stays private, always.  Though prior lapses raised alarms, they didn’t require sharing keys; just like now, safety lives in secrecy. Because access begins where trust ends, never hand over seed words. Even when pressure builds, silence protects better than any tool. Imagine a single line of words holding total power over digital money - this is what a recovery phrase does. Ownership shifts completely when someone else learns your seed phrase; control follows instantly. Companies making secure crypto devices do not ask customers to type these codes online or send them through messages.  Scanning it, emailing it, even mailing it physically - none of this ever happens if the provider is real. Trust vanishes fast when any official brand demands such sharing. Never type a recovery phrase anywhere except the hardware wallet during setup. When messages arrive with urgent requests, skip the QR scans entirely. Official sites hold the real answers - check there first. A single mistake could expose everything. Trust only what you confirm yourself.   A shift in cyber threats emerges as fake letters appear alongside rising crypto use. Not just online messages now - paper mail becomes a tool for stealing digital assets. The method adapts, reaching inboxes on paper before screens. Physical envelopes carry hidden risks once limited to spam folders. Fraud finds new paths when trust in printed words remains high.

Trezor and Ledger Impersonated in Physical QR Code Phishing Scam Targeting Crypto Wallet Users #CryptoWallet #CryptoWalletTheft #cryptocurrency

Grubhub Branding Misused to Promote Exponential Crypto Returns   The holiday season is a time when consumer engagement is at its peak and digital transactions are in the ascendant. However, a wave of misleading communication has been plaguing Grubhub's user community in recent weeks.  There has been an increase in the number of users of Grubhub's online food delivery platform that has been targeted by a coordinated email scam designed to mimic Grubhub's infrastructure in order to cultivate trust among its customers. It was falsely framed as part of a holiday crypto promotion. It used the authentic-sounding subdomain b.grubhub.com. The emails were derived from addresses typically associated with the company’s merchant partner outreach, appearing to have originated from those addresses.  The verified communications team at Grubhub uses a similar domain when communicating with restaurants and commercial partners, giving legitimacy to what has really been a malicious impersonation campaign in reality. A fraud email was sent to users that asked them to transfer Bitcoins to external wallets and promised a tenfold return within minutes. A widely circulated message claimed that there were only 30 minutes left in this promotion, asserting that any Bitcoin that was sent would be multiplied tenfold. This illustrates how the scam relies heavily on urgency and unrealistic financial incentives in order to convince victims.  In multiple reports, it is revealed that these emails were being dispatched from counterfeit email addresses resembling merchant support channels, including Grubhubforrestaurants and other restaurant-specific sender tags, for example. This scam, which has been active since December 24, displays a high level of personalization, as recipient names are embedded directly in the email's body and delivery metadata, which indicates structured data harvesting or prior exposure to breaches. Throughout the cryptocurrency fraud landscape, social engineering attacks have grown increasingly sophisticated, according to a study conducted by the University of Surrey. These attacks are raising renewed concerns about the misuse of digital trust and brand-based impersonation, and the exploitation of corporate identity, among other things.  It has been reported that recipients have received scam emails, titled merry-christmas-promotion and crypto-promotion, starting on December 24. The emails were both deceptively appended to the b.grubhub.com subdomain and embedded with their full names, along with their e-mail addresses, and contained personal identifiers such as their full names. It is without a doubt that this scam is one of the most textbook examples of high yield cryptocurrency reward scams, as it relies on psychological mechanics like trust, financial aspirations, and manufactured urgency so that it can deliver high returns with minimal investment. It is apparent from the attackers' narrative that they promised exponential returns on Bitcoin transfers, which is consistent with cryptocurrency fraud models that use implausible incentives to overcome skepticism.  According to some users and independent researchers, this breach could have been caused by a DNS takeover, a situation where forged emails would have passed through normal authentication checks. However, Grubhub has not yet officially confirmed any of these claims, nor has it provided any technical information regarding the breach.  BleepingComputer was informed by the company that the issue was identified within its merchant partner communications channels, and was promptly isolated from the issue, and that a full investigation is underway in order to prevent it from recurring in the future. A spokesperson from the platform also stated that containment measures were immediately implemented, suggesting that the platform does not view the incident as a routine spam attack, but rather as an attack on targeted integrity.  Additionally, the company also discussed Grubhub's disclosure earlier this year during the event. The Grubhub company reported at that time that a threat actor had accessed a large volume of contact information of customers, merchants, and delivery drivers - providing contact information, but not payment credentials - resulting in the discovery of the threat actor's access to the servers of the company as a result.  Even though the January breach is not related in structure in any way, experts note that previously exposed identity datasets are often resurfaced as raw material in impersonation campaigns a decade or two later, providing attackers with the level of personalization needed to appear credible and targeted to consumers.  There has been an escalation in digital fraud during high-traffic holiday periods, according to law enforcement agencies, a trend highlighted in a recent public advisory from the Federal Bureau of Investigation which cautioned consumers against the seasonal cycle of scams. According to the bureau, attackers deliberately increase their activities at times of high demand for discounts, limited-time offers, and fast money gains, deploying schemes that are based on expectations and urgency.  According to the FBI, non-payment scams and non-delivery scams were among the most frequently reported tactics in 2024, with victims misled into paying for goods or services that never materialized. There have been significant financial impacts on the financial system resulting from these frauds.  The FBI estimates that in 2024 alone, these frauds alone will account for more than $785 million in losses to users, while credit card frauds will contribute an additional $199 million. This reinforces the persistence of the profitability of financial crime driven by impersonation.  Additionally, investigators highlighted that phishing environments have evolved beyond traditional credential theft, and increasingly target passwords to cryptocurrency exchanges and accesses to digital wallets, where a single compromised account could allow the liquidation and transfer of assets immediately.  A recent FBI advisory has advised users to be cautious when clicking on unsolicited links. Authorities are warning that malicious landing pages are routinely being used to collect crypto-platform authentication details, such as multi-factor authentication codes, for the purpose of diversion of funds that may not be recoverable.  Researchers have drawn parallels between the ongoing Grubhub campaign and the more widespread crypto-doubling scam, a type of social engineering scam that engages in recognizable branding, individualized targeting, and a countdown-style deadline as a means to feign legitimacy and to eliminate suspicion.  In an effort to combat fraud, industry experts and national agencies have repeatedly said that communications that include verified-looking domain names, time-sensitive ultimatums, or requests for transfers to external wallets have been identified as some of the most obvious behavioral indicators.  In both Grubhub's guidance as well as from federal authorities, it is stressed that independent verification through official channels is a key component of ensuring authenticity, especially when messages are individually addressed. However, personalization no longer stands as a reliable sign of authenticity, but is often a sign that prior personal data exposure has been weaponized in order to enhance credibility.  There are many ramifications of the phishing campaign that go far beyond the theft of isolated amounts of money. They prompt a broader discussion of digital trust, corporate identity, and the fragility of brand credibility in an increasingly weaponized online environment. Although users who have been affected by this crypto-crisis are at direct risk of losing cryptocurrencies, Grubhub itself faces an equally troubling threat - the erosion of public confidence - which is not a case of an actual breach of security, but rather a perception of one.  As industry observers and researchers have noted for years, modern phishing operations are no longer dependent solely on technical intrusion; their success depends equally on psychological authenticity, which means familiar email formats, harvesting personal identifiers, and brand-aligned subdomains can alter the perception of phishing operations.  It has been emphasized that this incident has raised concerns about how cybercriminals are reusing previously disclosed identity datasets, which they routinely repurpose to personalize fraudulent outreach on a large scale, giving phishing mail the appearance of one-on-one legitimacy. Security commentators have warned that such events can create lasting doubt among consumers who may be unable to distinguish a genuine system lapse from a forged communication.  However, even if the corporate infrastructure remains intact, consumers may have difficulty distinguishing between a genuine system lapse, since their perception may be frightful. Additionally, the situation has also highlighted the growing gap between user preparedness and law enforcement agency preparedness, with cyber security experts emphasizing that the importance of phishing literacy is as crucial as the importance of a good password hygiene regimen.  The following precautions are recommended: Verifying unexpected financial or promotional claims through company channels rather than embedded links, strengthening account defenses with unique, high-entropy passwords, and enabling multi-factor authentication as soon as possible, especially in cryptocurrency exchange accounts, where credential theft can result in a quick, irreversible transfer of funds.  It has been reported that the campaign is part of a larger pattern of crypto-doubling social engineering fraud, which is a scam archetype that has been around for quite some time due to its perfect combination of technological deception with the strength of the promise of a big payday.  In light of the incident, the delivery platforms and digital marketplaces have been urged to intensify customer education initiatives, including technical monitoring as well as public awareness outreach, since the most effective defense against impersonation-driven fraud lies not only in one strategy, but in a combination of infrastructure resilience, informed skepticism, and a robust defensive strategy.

Grubhub Branding Misused to Promote Exponential Crypto Returns #BrandImpersonation #CryptoWalletTheft #CryptocurrencyFraud

Attributes of these #identitytheft rings include:

¹ #cryptowallettheft
² #breakingandentering coordination
³ #stalking
⁴ #theft

One thing #cryptocurrency has to fear is the #GreyMarket usage of #CALEAMalware in #cybersecurity by dodgy #OfficerProxy under surveillance for #cryptocurrency #theft by another #StateSponsoredMalware family.

#infosec #cryptowallettheft #memecoin […]

[Original post on infosec.exchange]