HuoXing Finance reports that security firm SlowMist has released an in-depth threat intelligence report on the DarkSword malware backend and iOS attack chain. The report tracks the evolution of this attack infrastructure and reveals its high-risk nature targeting cryptocurrency asset users. According to SlowMist’s analysis, following the public disclosure of exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed going live in late September. The SlowMist team not only tracked its online infrastructure but also linked its management panel to the publicly available GitHub repository, reverse-engineering the exploit code, delivery chain, and post-compromise capabilities. The report highlights several key findings of this attack framework: a highly automated end-to-end attack pipeline integrating exploit delivery, device and data collection, data exfiltration, and cryptocurrency wallet fund aggregation; extensive and deep data exfiltration capabilities targeting not only keychains, files, and information, but specifically cryptocurrency wallet data, with the ability to decrypt wallet data and consolidate funds. Although the toolkit claims compatibility with iOS 13 and above, code analysis confirms that its actual effective exploit window is limited to iOS 18.6–18.7.2 and iOS 26–26.1. The disclosed vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the barrier to launching sophisticated iOS attacks. In response to this threat, SlowMist provides clear security recommendations: users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in Safari can trigger the vulnerability. If a device has previously accessed a suspicious landing page, users must treat their mnemonic phrases and private keys as compromised and immediately create a new wallet on a clean device that has never visited the page, then transfer all assets. Additionally, users should thoroughly review all chain-based anomalous transactions and token approvals, and immediately revoke unnecessary authorizations.
SlowMist Report Reveals Weaponized iOS Wallet Attack Framework Targeting Crypto Users
MarsBitShare
Summary
A new on-chain security alert from SlowMist reveals a weaponized iOS wallet attack framework called DarkSword, targeting cryptocurrency users. The report details how the malware evolved after exploit code was disclosed in March 2026, with the DarkSword-PROV2 variant appearing on GitHub in July. The tool automates attacks to enable data theft and fund consolidation, operating on iOS 18.6–18.7.2 and iOS 26–26.1. SlowMist warns of a potential security breach and urges users to update iOS, avoid suspicious links, and treat any exposed private keys as compromised.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.