[SlowMist Releases DarkSword Trojan Analysis Report: Open Source Code Weaponized, iOS Crypto Wallets Face Threats] BlockBeats News, October 19 — Security firm SlowMist has released an in-depth threat intelligence report on the DarkSword Trojan backend and iOS attack chain. The report tracks the evolution of the attack infrastructure and reveals its high level of danger to cryptocurrency asset users. According to SlowMist's analysis, since the disclosure of related exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be operational by late September. The SlowMist team not only tracked its online infrastructure but also linked its management panel to publicly available GitHub repositories, dissecting the exploit code, delivery chain, and post-compromise capabilities. The report highlights several key findings about the attack framework: · A highly automated and complete attack pipeline, integrating exploit delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation functionalities. · Extensive and in-depth data theft capabilities, targeting not only Keychain, files, and information but specifically cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds. · Although the toolkit claims to support iOS 13 and later versions, code analysis confirms that its effective exploit window is concentrated in the iOS 18.6–18.7.2 and iOS 26.0–26.1 version ranges. · Publicly disclosed exploit components have been weaponized and integrated into deployable attack frameworks, significantly lowering the threshold for launching sophisticated iOS attacks. In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser could trigger the exploit. If a device has accessed a suspicious landing page, users should treat their mnemonic phrases and private keys as compromised. They must create a new wallet using a clean device that has never accessed the page and transfer their assets. Additionally, users should thoroughly check for abnormal transactions and token approvals across chains and immediately revoke unnecessary authorizations (Revoke). [Original Link]