SlowMist Discloses iOS Safari DarkSword Attack Chain Targeting Wallets

ChainCatcher report: According to the SlowMist Security Team, they have detected a phishing attack disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 through 18.6.2. The attackers exploit a complete attack chain comprising six vulnerabilities codenamed "DarkSword," encompassing WebKit remote code execution, sandbox escape, and kernel read/write capabilities. This enables them to silently extract App container files and keychain data, and record keyboard inputs when wallets such as imToken, TokenPocket, or TronLink are in the foreground. SlowMist confirmed that all six vulnerabilities have since been patched by Apple, and the current attack represents the reuse of an n-day exploit chain. Simply visiting the malicious page does not definitively prove that seed phrases or private keys have been compromised; device forensics are required for confirmation. iOS and iPadOS users are advised to update their systems to version 18.7.3 or 26.3 and above as soon as possible.