Google researchers have identified an iOS exploit chain being used in the wild that can be used to deliver malware that specifically targets cryptocurrency apps on vulnerable iPhones.
Multiple actors are deploying the exploit, ranging from commercial spyware vendors to state-backed groups, with campaigns observed in Saudi Arabia using a fake Snapchat lookalike, and in Ukraine through compromised websites including a government site.
Ghostblade is designed for quick data theft rather than long-term surveillance—it collects all available data, then deletes its temporary files and terminates itself.
