Google Flags ‘Ghostblade’ Malware Targeting Crypto Users

Google Threat Intelligence has discovered a new malware called “Ghostblade,” part of the “DarkSword” suite, designed to steal crypto private keys and sensitive user data on Apple iOS devices. Written in JavaScript, Ghostblade activates briefly to extract information before shutting down, making detection difficult.

Data Theft and Capabilities

The malware can access messaging apps, including iMessage, Telegram, and WhatsApp, as well as SIM card details, identity data, multimedia files, geolocation, and system settings. It also deletes crash reports from compromised devices to avoid detection by Apple’s security systems. Ghostblade operates without plug-ins and stops after extracting data, highlighting its stealth-focused design.

Trends in Crypto Cybercrime

While crypto hack losses fell from $385 million in January to $49 million in February, malicious actors increasingly target users through phishing, wallet poisoning, and other human-error exploits. Fake websites mimicking legitimate services often embed malware like Ghostblade, enabling attackers to access crypto assets and sensitive personal information.

Cybersecurity researchers continue to monitor threats like DarkSword to protect users and institutional investors from evolving malware and phishing attacks in the digital asset ecosystem.

Disclaimer

This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.