BlockBeats report: On October 19, the security firm SlowMist released an in-depth threat intelligence report on the DarkSword malware backend and iOS attack chain. The report traces the evolution of this attack infrastructure and reveals its high danger to cryptocurrency asset users.
According to SlowMist's analysis, following the public disclosure of exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be live by late September. The SlowMist team not only tracked its online infrastructure but also linked its management panel to the publicly available GitHub repository, and deconstructed the exploit code, delivery chain, and post-compromise capabilities. The report highlights several key findings regarding this attack framework:
A highly automated full attack pipeline integrating vulnerability delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation.
· Extensive and deep data theft capabilities; this toolkit targets not only Keychain, files, and information, but also specifically targets cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds.
Although the toolkit claims to support iOS 13 and later, code analysis confirms that its actual effective exploitation window is limited to the iOS 18.6–18.7.2 and iOS 26.0–26.1 version ranges.
Publicly known vulnerable components have been weaponized and integrated into deployable attack frameworks, significantly lowering the barrier to launching sophisticated iOS attacks.
In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser can trigger the vulnerability. If a device has previously accessed a suspicious landing page, users should treat their mnemonic phrases and private keys as compromised and must create a new wallet on a clean device that has never visited the page, then transfer their assets. Additionally, users should thoroughly review all chain-specific transactions and token approvals for anomalies and immediately revoke any unnecessary approvals.