📢 Flash
SlowMist Releases DarkSword Trojan Analysis Report: Public Code Weaponized, iOS Crypto Wallets at Risk
On October 19, cybersecurity firm SlowMist released an in-depth threat intelligence report focusing on the DarkSword Trojan’s backend and its full attack chain targeting iOS devices. The report systematically reconstructs the evolution of the attacker’s infrastructure and explicitly highlights the severe, real-world risks it poses to cryptocurrency users.
According to SlowMist’s analysis, following the public release of exploit code in March 2026, DarkSword-PROV2 first appeared on GitHub in July of the same year. By late September, its associated attack infrastructure had been observed going live and entering active operational use. The SlowMist team not only continuously monitored its live infrastructure but also successfully linked the command-and-control (C2) panel with publicly available GitHub repositories. Furthermore, they reverse-engineered and functionally validated the exploit modules, malicious delivery vectors, and lateral movement capabilities deployed post-compromise.
Key findings disclosed in the report include:
· A highly automated end-to-end attack pipeline—covering exploit-triggered delivery, device fingerprinting and sensitive data collection, multi-dimensional data exfiltration, and targeted consolidation of funds from compromised crypto wallets;
· Expanded data theft scope beyond conventional targets: in addition to Keychain, local files, and SMS messages, the toolkit features enhanced extraction capabilities specifically for cryptocurrency wallet data—including wallet decryption and direct fund transfers;
· Although officially claimed to support iOS 13 and later, code-level analysis confirms effective exploitation is limited to just two narrow version ranges: iOS 18.6–18.7.2 and iOS 26.0–26.1;
· The originally public exploit components have been deeply weaponized and seamlessly integrated into a ready-to-deploy attack framework—significantly lowering the technical barrier for launching stealthy iOS attacks.
In response to these threats, SlowMist recommends concrete mitigation steps: Users must promptly update their iOS systems and avoid clicking links from untrusted or unknown sources—since merely opening a malicious page in Safari is sufficient to trigger the vulnerability. If a device has visited any suspicious landing page, users should immediately assume their mnemonic phrases and private keys have been compromised and must rebuild their wallets from scratch using a completely clean, uncompromised device before migrating all assets. Additionally, users should conduct a comprehensive audit of anomalous transactions and token approval statuses across all blockchain networks—and immediately revoke (Revoke) all unnecessary approvals.
According to SlowMist’s analysis, following the public release of exploit code in March 2026, DarkSword-PROV2 first appeared on GitHub in July of the same year. By late September, its associated attack infrastructure had been observed going live and entering active operational use. The SlowMist team not only continuously monitored its live infrastructure but also successfully linked the command-and-control (C2) panel with publicly available GitHub repositories. Furthermore, they reverse-engineered and functionally validated the exploit modules, malicious delivery vectors, and lateral movement capabilities deployed post-compromise.
Key findings disclosed in the report include:
· A highly automated end-to-end attack pipeline—covering exploit-triggered delivery, device fingerprinting and sensitive data collection, multi-dimensional data exfiltration, and targeted consolidation of funds from compromised crypto wallets;
· Expanded data theft scope beyond conventional targets: in addition to Keychain, local files, and SMS messages, the toolkit features enhanced extraction capabilities specifically for cryptocurrency wallet data—including wallet decryption and direct fund transfers;
· Although officially claimed to support iOS 13 and later, code-level analysis confirms effective exploitation is limited to just two narrow version ranges: iOS 18.6–18.7.2 and iOS 26.0–26.1;
· The originally public exploit components have been deeply weaponized and seamlessly integrated into a ready-to-deploy attack framework—significantly lowering the technical barrier for launching stealthy iOS attacks.
In response to these threats, SlowMist recommends concrete mitigation steps: Users must promptly update their iOS systems and avoid clicking links from untrusted or unknown sources—since merely opening a malicious page in Safari is sufficient to trigger the vulnerability. If a device has visited any suspicious landing page, users should immediately assume their mnemonic phrases and private keys have been compromised and must rebuild their wallets from scratch using a completely clean, uncompromised device before migrating all assets. Additionally, users should conduct a comprehensive audit of anomalous transactions and token approval statuses across all blockchain networks—and immediately revoke (Revoke) all unnecessary approvals.
