Security Notice Regarding Abnormal Scripts Injected into BlockBeats Webpages

This week, multiple security firms reported security vulnerabilities related to DarkSword to BlockBeats. Upon investigation, it was found that on October 22, a content page titled "Global Market Risk-Off Sentiment..." on BlockBeats' mobile web H5 page was copied by an attack team, which injected a piece of abnormal script from a third-party domain. When users search for that news flash on the page, both the original news flash and the malicious news flash with the injected script appear in the search results. We reproduced the issue immediately upon confirmation and completed cleanup and remediation.

Meanwhile, since the actual effective exploitation window for DarkSword-related security vulnerabilities is concentrated in two version ranges — iOS 18.6–18.7.2 and iOS 26.0–26.1 — we also remind all iOS users to upgrade to the latest iOS 27 system in a timely manner.

After this week's global PHP vulnerability incident, BlockBeats has investigated more than dozens of related vulnerabilities, and technical staff are continuing the investigation.

It must be emphasized that BlockBeats has never supported any "wallet login" or "connect wallet" feature. Any BlockBeats App that requires "wallet login" or "connect wallet" is a third-party fake App. BlockBeats will further strengthen the access review and change management of third-party scripts, continuously monitor external resources loaded on pages, and improve the alerting and handling processes for abnormal situations.

We would also like to thank security firms including SlowMist and GCSA for their assistance provided at the earliest opportunity. We express our gratitude here to everyone on the front lines safeguarding the security of the industry.