In this article6 sections
A long-time member of the Shiba Inu community who posts on X as Mazrael issued a security reminder on November 5, 2026, telling iPhone users that Google’s Threat Intelligence team had detailed an iOS exploit chain called DarkSword, U.Today reported.
According to the post, the chain can reportedly take full control of iPhones running iOS 18.4 through iOS 18.7 simply when a user visits a booby-trapped website. One of the spyware tools linked to it reportedly goes after cryptocurrency wallet data and device keychains, as well as messages, photos and passwords.
Also readSHIB, ZEC, XMR, DOGE Sellers Keep Upper Hand: Oct 14 Levels
Key facts
- Mazrael’s post on X is dated November 5, 2026, and cites Google’s Threat Intelligence team as the source of the DarkSword disclosure.
- The exploit reportedly affects iPhones on iOS 18.4 to iOS 18.7 and needs only that the user open a malicious site.
- Google said DarkSword has so far been used in targeted attacks in Saudi Arabia, Turkey, Malaysia and Ukraine by spyware vendors and suspected state hackers.
- The reminder says the vulnerabilities are fixed in iOS 26.3 and later.
Advice for iPhone owners holding crypto
The reminder sets out a short list of steps. Its first instruction is to install the latest iOS release through Settings, then General, then Software Update, noting that the flaws are closed in iOS 26.3 or newer. For users who cannot update, it recommends switching on Apple’s Lockdown Mode.
It also asks users to avoid opening unknown links, with a particular warning about links that present themselves as crypto-related. Anyone who believes a device or wallet credentials were exposed is told to set up a new wallet on a clean, updated device, move the funds and never reuse an exposed seed phrase. Mazrael summed up the reasoning in the post by noting that a safe wallet on an unsafe phone is not safe.
Also readYakovenko: Phishing Outranks AI as Top Crypto Threat
Google’s warning on wider use
The post relayed Google’s view that although DarkSword has so far appeared in targeted campaigns, other attackers may also be using it. That point is what makes the reminder relevant beyond the four countries named, because the exposure described is tied to the phone’s iOS version rather than to a particular victim profile.
The warning lands on a crypto audience that increasingly reaches wallet services and other sensitive accounts from mobile devices, where a compromised keychain or password store can expose a seed phrase as easily as a wallet app itself.
Binance withdrawal caution
The same community update flagged separate phishing risk around Binance, which has resumed withdrawals in phases, including SHIB on the Ethereum network. Binance warned that scammers may pose as the exchange through direct messages, emails, group chats and even small transfers carrying a note, offering to speed up withdrawals, give priority processing, help claim compensation or move assets into a Binance vault.
The exchange said it will never contact users first about their account or funds, and will not sell a place in a withdrawal queue or charge a fee to unlock a network or asset.
Why it matters
The two warnings point at the same weak link: a holder’s own device and inbox, not the blockchain. A phone that is fully controlled by spyware can quietly expose the credentials behind a wallet, and a convincing message can get a user to hand over funds without any exploit at all. The practical answer to both is procedural — patch promptly, treat unsolicited approaches as suspect and move funds off any device considered compromised.
What to watch
The next measurable step is how quickly affected iPhone owners move to iOS 26.3 or later, since that is where the post says the flaws are closed. Google’s Threat Intelligence output on further DarkSword use, and any new Binance guidance as phased withdrawals continue, are the items likely to update this story.
This article is not financial advice; crypto markets are volatile and uncertain.
Source: U.Today
