SlowMist Report Reveals Weaponized Code Threatening iOS Crypto Wallets

ChainCatcher report: Security firm SlowMist has released an in-depth threat intelligence report on the DarkSword malware backend and iOS attack chain. The report traces the evolution of this attack infrastructure and reveals its high-risk nature targeting cryptocurrency asset users.

According to SlowMist's analysis, following the public disclosure of the exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be live by late September.

The SlowMist team not only tracked its online infrastructure but also linked its management panel to publicly available GitHub repositories, and analyzed the exploit code, delivery chain, and post-compromise capabilities. The report highlighted several key findings of this attack framework: a highly automated end-to-end attack pipeline integrating vulnerability delivery, device and data collection, data exfiltration, and cryptocurrency wallet fund aggregation.

Extensive and deep data-stealing capabilities; this toolkit targets not only keychains, files, and information, but specifically focuses on cryptocurrency wallet data, enabling decryption of wallet data and fund aggregation. Although the toolkit claims support for iOS 13 and later, code analysis confirms that its actual effective exploitation window is limited to iOS 18.6–18.7.2 and iOS 26–26.1. Publicly disclosed vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the barrier to launching sophisticated iOS attacks.

In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser could trigger the vulnerability. If a device has previously accessed a suspicious landing page, users should treat their mnemonic phrases and private keys as compromised and must create a new wallet on a clean device that has never visited the page, then transfer their assets.

Additionally, users should thoroughly review all anomalous transactions and token approvals across chains and immediately revoke any unnecessary approvals.