SlowMist: Public code has been weaponized, iOS encrypted wallets face threats

The security agency SlowMist has released a deep threat intelligence report on the DarkSword Trojan backend and iOS attack chain. The report tracks the evolution of this attack infrastructure and reveals its high danger to cryptocurrency asset users. According to SlowMist's analysis, after the relevant exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be online in late September.

The SlowMist team not only tracked its online infrastructure but also linked its management panel to public GitHub repositories, dissecting the exploit code, delivery chain, and post-compromise capabilities. The report highlights several key findings of this attack framework: a highly automated complete attack pipeline that integrates vulnerability delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation functions. The extensive and in-depth data theft capabilities of this toolkit target not only keychains, files, and information but also specifically cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds. Although the toolkit claims to support iOS 13 and above, code analysis confirms that its actual effective exploit window is concentrated in the iOS 18.6--18.7.2 and iOS 26--26.1 version ranges. The publicly available vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the threshold for launching complex iOS attacks.

In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser may trigger vulnerabilities. If a device has accessed suspicious landing pages, users should consider their mnemonic phrases and private keys as compromised and must create new wallets and transfer assets using a clean device that has never accessed that page. Additionally, users should thoroughly check for abnormal transactions and token authorizations across various chains and immediately revoke unnecessary authorizations.