Báo cáo của SlowMist tiết lộ khung tấn công ví iOS được vũ trang nhắm vào người dùng tiền điện tử

The Huoxing Finance report states that the security firm SlowMist has released an in-depth threat intelligence report on the DarkSword malware backend and iOS attack chain. The report tracks the evolution of this attack infrastructure and reveals its high-level danger to cryptocurrency asset users. According to SlowMist’s analysis, following the public disclosure of exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed going live in late September. The SlowMist team not only tracked its online infrastructure but also linked its management panel to the publicly available GitHub repository, and disassembled the exploit code, delivery chain, and post-compromise capabilities. The report highlights several key findings of this attack framework: a highly automated end-to-end attack pipeline integrating exploit delivery, device and data collection, data exfiltration, and cryptocurrency wallet fund aggregation; extensive and deep data exfiltration capabilities targeting not only keychains, files, and information, but specifically cryptocurrency wallet data, with the ability to decrypt wallet data and consolidate funds. Although the toolkit claims compatibility with iOS 13 and above, code analysis confirms that its actual effective exploit window is limited to iOS 18.6–18.7.2 and iOS 26–26.1. The disclosed vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the barrier to launching complex iOS attacks. In response to this threat, SlowMist provides clear security recommendations: users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in Safari could trigger the vulnerability. If a device has previously accessed a suspicious landing page, users should treat their mnemonic phrases and private keys as compromised and must create a new wallet on a clean device that has never visited the page, then transfer assets. Additionally, users should thoroughly review all chain-specific anomalous transactions and token approvals, and immediately revoke unnecessary authorizations.