DarkSword is a multi-stage iPhone attack chain that can begin when a user visits a malicious or compromised website in Safari and, if successful, reach kernel-level privileges that expose sensitive device data, including cryptocurrency wallet credentials. Google Threat Intelligence Group said the chain used six vulnerabilities against targets in Turkey, Saudi Arabia, Malaysia and Ukraine beginning in November 2025, with confirmed versions affecting iOS 18.4 through iOS 18.7. Apple had patched all six vulnerabilities by iOS 26.3 at the latest and later released iOS 26.7 on September 14, 2026. Claims that DarkSword affects every release from iOS 13 through iOS 26.5, including current versions, have not been independently verified. Researchers recommend installing current iOS updates, using Lockdown Mode on high-risk or unsupported devices, avoiding untrusted Safari links and keeping private keys or recovery phrases off phones.