More than 1,500 phishing sites targeting iPhone and iPad users’ cryptocurrency have been found. A warning said operating system updates are urgent because some attacks can steal information from a device simply by accessing a malicious webpage.

On Oct. 26, Japan's CoinPost reported that security firm SlowMist said on Oct. 24 it had confirmed more than 1,500 phishing sites linked to the DarkSword iPhone hacking tool.

The investigation was conducted through SlowMist's threat monitoring system, MistEye. The attack sites impersonated major cryptocurrency exchanges including Binance and OKX, as well as online shopping malls, cryptocurrency wallets and game services.

DarkSword is a tool that attacks by chaining six security vulnerabilities in Apple's iOS operating system. An attack can begin when a malicious page is opened in the Safari web browser, and it bypasses security controls that restrict app-by-app access permissions.

Key targets include passwords stored on devices, private keys for cryptocurrency wallets and memo data. In particular, if seed phrases needed to recover wallets are leaked, users risk having their cryptocurrency assets stolen.

In a separate report released on Oct. 19, SlowMist also confirmed operational logs from an actual attack server. The server recorded 20,187 page views and 1,187 intrusion attempts over the past 30 days. Of these, 10 intrusions succeeded and nine progressed to the data-leak stage. It said the figures were for a specific attack server and do not indicate the scale of damage across all 1,500 phishing sites that were found. The amount of cryptocurrency stolen was also not confirmed.

DarkSword attack code was disclosed to the security industry in March and later leaked online, and attack tools using it have also spread.

Apple fixed all related vulnerabilities through iOS 26.3. For users on older operating systems, it expanded eligibility for iOS 18.7.7 support in April.

SlowMist urged users to install the latest security updates and not to store wallet private keys or seed phrases in memo apps. If an infection is suspected, it recommended creating a new wallet on another secure device and transferring assets.