SlowMist Finds Public DarkSword Code in Deployable iOS Attack Kit

A deployable iOS attack framework built from public DarkSword exploit code can steal crypto wallet data, creating an immediate risk for users on a narrow range of software versions. Its effective exploit coverage is concentrated on iOS 18.6 through 18.7.2 and iOS 26.0 through 26.1. The toolkit claims support for iOS 13 and later, but the working exploit range is narrower. The attack chain automates exploit delivery, device and data collection, theft and cryptocurrency fund consolidation. It targets the iPhone Keychain, files, messages and wallet data, and includes functions to decrypt wallet information and consolidate funds. Public exploit components became available in March 2026. DarkSword-PROV2 appeared on GitHub in July, and the associated infrastructure was observed running in late September. A malicious page opened in Safari may trigger an exploit.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TokenPost.