Google researchers have identified an iOS exploit chain being used to deliver malware that targets cryptocurrency apps on vulnerable iPhones. The exploit, named DarkSword, leverages six vulnerabilities to deploy malware on devices running iOS versions 18.4 through 18.7. The malware includes a JavaScript-based data stealer named Ghostblade, which actively targets major crypto exchange apps such as Coinbase, Binance, Kraken, and MEXC. Multiple actors are using the exploit, including commercial spyware vendors and state-backed groups.