DarkSword malware hunts for crypto on iOS, and GPT-5.6 Sol hacks Chrome in 6 days
The cybersecurity of the cryptocurrency sector faced a double blow: researchers recorded the active spread of DarkSword malware aimed at the iOS ecosystem, and at the same time assessed the dangers of the new AI model GPT-5.6 Sol, which managed to find a critical zero-day vulnerability in Google Chrome in just six days. The situation creates unprecedented risks for mobile and browser wallets, forcing developers to urgently reconsider security standards. A new wave of cyber threats shows that the DarkSword iOS theft of GPT-5 cryptocurrency is becoming one of the most discussed digital security topics in 2026.
How does the DarkSword attack on Apple mobile devices work?
DarkSword malware is distributed through fake TestFlight beta test profiles and compromised web applications (PWAs). Unlike previous generations of mobile stealers, the malware bypasses the iOS sandbox by exploiting a chain of vulnerabilities in the WebKit engine.
The main purpose of DarkSword is to read the system clipboard, scan screenshots for mnemonic phrases, and spoof recipient addresses when calling smart contracts. Users of the MetaMask, Trust Wallet and Phantom mobile interfaces were at greatest risk.
| Attack vector | Target component | Risk level |
|---|---|---|
| TestFlight / PWA | iOS Clipboard and Photo Gallery | Critical |
| WebKit Zero-Day | Local storage keys | High |
Why is the GPT-5.6 Sol AI agent dangerous for browser wallets?
In parallel with the mobile threat, specialists from the AI Security Lab published a report on tests of the autonomous AI agent GPT-5.6 Sol. The neural network was tasked with finding a security hole in the Chrome browser without human intervention. It took the AI exactly 144 hours to detect a critical Use-After-Free vulnerability and create a working exploit.
Automating the search for vulnerabilities using GPT-5.6 dramatically reduces the entry barrier for attackers. Browser wallet extensions remain extremely vulnerable, as browser kernel-level exploits allow unencrypted private keys to be extracted directly from the process’s RAM.
How to secure digital assets in the new realities?
The market reaction was manifested in a sharp increase in demand for hardware wallets with an isolated environment (Air-Gapped). Experts recommend that users take urgent measures to protect their funds:
- Exclude the storage of seed phrases in the galleryand text notes of the smartphone – DarkSword scans the media library in the background.
- Clean up unused WebApp profilesand revoke TestFlight permissions for unfamiliar services.
- Transfer the bulk of funds to hardware walletsthat sign offline transactions via QR codes.
The current situation proves that hybrid threats combining targeted mobile malware and AI-generated exploits require users to completely abandon storing significant amounts of money in hot wallets.
