Slow Fog CISO: Underground forums are selling remote control tools claiming to support iOS 13 to 27.2, which can steal keychain and encrypted wallet data

The CISO of Slow Fog stated that there are underground forums selling a remote control tool claimed to support iOS versions 13 to 27.2, equipped with a centralized control panel.

Attackers are said to be able to deliver phishing links via SMS, chat software, or email, attempting to gain device access after users click on them, thereby stealing Keychain data, chat records, file credentials, and data related to encrypted wallets. They can also monitor cameras, microphones, location, and screens, and support remote Shell and multi-device management.

The tool claims to have six capabilities: initial access, privilege escalation, persistence after reboot, data export, real-time monitoring, and remote control, involving techniques such as bypassing pointer authentication (PAC), escaping sandboxes, and obtaining kernel read/write permissions.

However, the CISO of Slow Fog expressed doubts about its compatibility, believing that its claim to support iOS 27.2 may be exaggerated or have stability issues, and speculated that the tool could be an upgraded version of Darksword. They also reminded users to update their systems in a timely manner, exercise caution when clicking on unknown links in SMS, emails, and chat software, and pay attention to the security of their devices and encrypted assets.