SlowMist releases DarkSword Trojan analysis report: public code weaponized, iOS crypto wallets under threat

BlockBeats news, October 19 - Security firm SlowMist has released an in-depth threat intelligence report on the DarkSword trojan backend and iOS attack chain. The report traces the evolution of the attack infrastructure and reveals its high danger to crypto asset users.

According to SlowMist's analysis, after the relevant exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be online and operational in late September. The SlowMist team not only tracked its online infrastructure but also linked its management panel to public GitHub repositories, and deconstructed the exploit code, delivery chain, and post-compromise exploitation capabilities. The report highlights several key findings about the attack framework:

· A highly automated full attack pipeline that integrates vulnerability delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation functions.

· Extensive and deep data theft capabilities. The toolkit targets not only Keychain, files, and messages, but also specifically crypto wallet data, with the ability to decrypt wallet data and consolidate funds.

· Although the toolkit claims to support iOS 13 and later versions, code analysis confirms that its actual effective exploitation window is concentrated in two version ranges: iOS 18.6–18.7.2 and iOS 26.0–26.1.

· Publicly available exploit components have been weaponized and integrated into a deployable attack framework, greatly lowering the barrier to launching sophisticated iOS attacks.

In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking untrusted links, because simply opening a malicious page in the Safari browser may trigger the vulnerability. If a device has ever visited a suspicious landing page, users should directly treat their mnemonic phrases and private keys as compromised, and must use a clean device that has never visited that page to create a new wallet and transfer assets. In addition, users need to comprehensively check for abnormal transactions and token approvals across various chains, and immediately revoke unnecessary approvals (Revoke).