Why does the DarkSword warning mean you should update your iPhone today if you use a crypto wallet?

CertiK warned on Nov 6, 2026 that an updated DarkSword exploit kit — six flaws affecting iOS 18.4 to 18.7, first detailed by Google Threat Intelligence — can compromise an unpatched iPhone through a malicious Safari page visit alone, then scan wallets including MetaMask, Trust Wallet, Phantom, Exodus and Coinbase. Update via Settings today, keep seed phrases off your phone, and move funds to a fresh wallet if a device may be compromised.

Short answer: because security firm CertiK warned on November 6, 2026 that an updated version of the DarkSword iOS exploit kit can compromise an unpatched iPhone running iOS 18.4 to 18.7 through a malicious Safari page visit alone — no download, no wallet connection, no transaction approval. Once inside, it scans the phone for crypto wallets — CertiK names MetaMask, Trust Wallet, Phantom, Exodus and Coinbase — and for passwords and recovery phrases stored on the device. Malicious ads promoting the trap pages have been seen on Instagram.Why it matters: most phone attacks need you to install something or tap ‘approve’.

This one needs only a web page, and it chains six flaws first detailed by Google’s Threat Intelligence Group — flaws Apple has already fixed in newer iOS versions. That makes the update itself the whole defense for most people: the gap between a patched phone and an unpatched one is exactly the gap the attackers are farming.Protect yourself, step by step:1. Update today: open Settings > General > Software Update and install the latest iOS offered for your phone, on Wi-Fi and plugged in.2.

Turn on automatic updates in that same screen, so security fixes land without you having to hear about them first.3. Avoid unfamiliar links until you have updated — especially ads and messages pushing crypto giveaways or wallet ‘verification’ pages.4. Never store a seed phrase in Photos, Notes or screenshots: write it on paper and keep it offline.

Anything the phone can display, malware on the phone can read.5. If your phone may already be compromised — wallet activity you do not recognise is the big sign — move funds to a brand-new wallet with a brand-new recovery phrase, set up on a patched device.Pro tip: the common mistake is ‘verifying’ a wallet on a web page someone sent you. A legitimate wallet app never asks you to type your recovery phrase into a website; anyone who asks is the attack.