Last mentioned: Mar 23, 2026
Industry Response
Cybersecurity firms begin updating threat signatures to detect DarkSword-based spyware deployments.
Mirroring Commences
The exploit kit is mirrored across Telegram and alternative hosting sites, making total removal impossible.
Initial Leak
The DarkSword repository is discovered on GitHub, containing functional exploit code for iOS.
Public Reporting
TechCrunch and Yahoo Tech publish reports detailing the threat to millions of legacy iPhone users.
Mitigation Phase
Security experts recommend users audit their mobile wallet permissions and update iOS devices.
Industry Warning
Cybersecurity analysts issue warnings to iOS users regarding mobile wallet security.
Industry Alert
Security news outlets begin reporting on the specific risks to iOS users.
Malware Flagged
Google Threat Intelligence officially identifies Ghostblade as a crypto-stealing threat.
Lineage Confirmed
Researchers link Ghostblade to the established DarkSword malware family.
Initial Discovery
Google Threat Intelligence flags Ghostblade as a new crypto-stealing threat.
Family Identification
Researchers link Ghostblade to the existing DarkSword malware lineage.
A sophisticated exploit kit dubbed "DarkSword" has been publicly leaked on GitHub, providing cybercriminals with tools to compromise millions of iPhones running older iOS versions. The leak enables the deployment of spyware, highlighting the persistent security risks faced by users on legacy mobile operating systems.
Google Threat Intelligence has identified 'Ghostblade,' a sophisticated crypto-stealing malware targeting Apple's iOS ecosystem. Linked to the DarkSword malware family, this discovery highlights an escalating threat to mobile-first cryptocurrency users on platforms previously considered highly secure.
Google Threat Intelligence has uncovered Ghostblade, a sophisticated malware variant targeting Apple iOS users to steal cryptocurrency assets. Part of the broader DarkSword malware family, this discovery highlights an escalating trend of mobile-specific threats aimed at digital asset holders.