Google Threat Intelligence Group disclosed that an iOS full-chain attack tool named DarkSword has been reused by multiple threat actors since November 2025. The attack chain targets iOS 18.4–18.7, exploiting 6 vulnerabilities to achieve complete device control and deploy various malicious programs. Payloads such as GHOSTBLADE can steal sensitive data including crypto wallet data, private keys/seed phrases, transaction records, and account information. The related vulnerabilities have been patched, and Google recommends users update their systems promptly or enable Lockdown Mode.