SlowMist phát hiện chuỗi lỗ hổng DarkSword trên iOS Safari nhắm vào các ví tiền điện tử

The Huoxing Finance report, according to the SlowMist Security Team, revealed an attack campaign disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2. The attackers exploited a complete attack chain comprising six vulnerabilities codenamed DarkSword, covering WebKit remote code execution, sandbox escape, and kernel read/write capabilities, enabling them to silently extract App container files and keychain data, and record keyboard inputs when wallets such as imToken, TokenPocket, or TronLink are in the foreground. SlowMist stated that all six vulnerabilities have since been patched by Apple, and the current attack is a reuse of an n-day vulnerability chain. Simply visiting a malicious page does not directly confirm that recovery phrases or private keys have been stolen; device forensics are still required for confirmation. Users of iOS/iPadOS are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.