SlowMist|Oct 24, 2026 05:13
🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users
⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.
DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.
🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.
🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.
📖 Related SlowMist analyses:
🔗 DarkSword Trojan Backend & iOS Attack Chain:
https://slowmist.medium.com/threat-intelligence-analysis-of-the-darksword-trojan-backend-and-ios-attack-chain-397ecf499fa8
🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
https://slowmist.medium.com/threat-intelligence-analysis-of-fomopeek-app-store-poisoning-and-ios-kernel-exploitation-e568762d11ca
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink