Summary
Security researchers have documented a new iPhone spyware variant specifically engineered to identify and extract cryptocurrency wallet data from infected devices, including private keys, seed phrases, and wallet application data. Unlike generic iOS spyware that targets communications and location data, this variant includes dedicated modules for scanning installed applications for cryptocurrency wallet software, extracting wallet databases, and exfiltrating private keys and seed phrases to attacker-controlled infrastructure. A compromised device gives attackers complete, irrecoverable access to all cryptocurrency holdings accessible from that device.
Timeline
| Date | Event |
|---|---|
| Oct 11, 2026 | Security researchers document iPhone spyware variant with cryptocurrency wallet targeting capability; Cryptoslate reports |
What Happened
The spyware variant scans the infected iPhone for installed cryptocurrency wallet applications including hardware wallet companion apps, software wallets, and exchange applications that cache credentials locally. Its primary targets are seed phrases — the 12 or 24-word recovery phrases that provide complete control over a cryptocurrency wallet regardless of device — and private key files stored in wallet application sandboxes. The spyware accesses iOS application data through the same class of sandbox escape vulnerabilities used by commercial spyware tools documented in prior TTO bulletins.
The targeting of seed phrases is significant because seed phrase compromise is permanent and device-independent — a seed phrase extracted from an iPhone can be used to drain a hardware wallet, a software wallet, or any wallet derived from the same recovery phrase across any device. Users who believe their iPhone may have been compromised should immediately move cryptocurrency holdings to a new wallet generated on a clean device before the existing wallet is drained. Enabling Lockdown Mode on iOS significantly reduces the attack surface available to spyware of this class.
Domain Intelligence
apple.com — 70.56
apple.com scores at 70.56. Apple is the developer of the iOS platform targeted by the spyware. Score unchanged from TTO-2026-1010-237.