{
  "version": 1,
  "event_id": "evt_5ee68c8adcd5b60d",
  "url": "https://xiyu.news/events/evt_5ee68c8adcd5b60d/",
  "json": "https://xiyu.news/api/events/evt_5ee68c8adcd5b60d.json",
  "type": "security_incident",
  "status": "developing",
  "category": "crypto",
  "title": {
    "zh": "【慢雾：DarkSword 木马已被投入实际攻击，部分 iOS 26 版本也受影响】",
    "en": "【慢雾：DarkSword 木马已被投入实际攻击，部分 iOS 26 版本也受影响】"
  },
  "current_state": {
    "zh": "SlowMist 持续警告 DarkSword 针对 iOS 加密货币用户发起攻击，利用 iOS 漏洞突破沙盒，窃取 Keychain 密码、钱包本地私钥和备忘录等数据；并建议用户及时更新 iPhone/iPad 系统、警惕已安装 App 遭投毒。",
    "en": "SlowMist continues to warn that DarkSword targets iOS crypto users, exploiting iOS vulnerabilities to break sandbox protections and steal Keychain credentials, local wallet private keys, and notes; it advises users to promptly update iPhone/iPad systems and beware poisoned installed apps."
  },
  "first_seen_at": "2026-10-19T14:11:32.285290+00:00",
  "last_updated_at": "2026-10-24T01:55:29.473773+00:00",
  "last_material_change_at": "2026-10-24T01:55:29.473773+00:00",
  "confidence": 0.75,
  "updates_count": 2,
  "sources_count": 2,
  "entities": [
    "darksword"
  ],
  "identifiers": [],
  "topics": [
    "crypto-wallet-security",
    "crypto-wallets",
    "darksword",
    "ios-malware",
    "ios-security",
    "malware",
    "slowmist"
  ],
  "updates": [
    {
      "update_id": "upd_a19c373ea57d91d9",
      "event_id": "evt_5ee68c8adcd5b60d",
      "occurred_at": "2026-10-19T11:53:18Z",
      "published_at": "2026-10-19T11:53:18Z",
      "first_seen_at": "2026-10-19T14:11:32.285290Z",
      "time_precision": "published",
      "update_type": "initial",
      "material_change": true,
      "title_zh": "【慢雾：DarkSword 木马已被投入实际攻击，部分 iOS 26 版本也受影响】",
      "title_en": "【慢雾：DarkSword 木马已被投入实际攻击，部分 iOS 26 版本也受影响】",
      "what_changed_zh": "SlowMist警告称，DarkSword-PROV2木马正被积极利用，通过受影响的iOS 18.6–18.7.2和iOS 26.0–26.1设备上的恶意Safari页面窃取iOS钥匙串数据、文件、信息和加密钱包信息。",
      "what_changed_en": "SlowMist warns that the DarkSword-PROV2 trojan is actively exploited to steal iOS Keychain data, files, messages, and crypto wallet information via malicious Safari pages on affected iOS 18.6–18.7.2 and iOS 26.0–26.1 devices.",
      "current_state_zh": "SlowMist警告称，DarkSword-PROV2木马正被积极利用，通过受影响的iOS 18.6–18.7.2和iOS 26.0–26.1设备上的恶意Safari页面窃取iOS钥匙串数据、文件、信息和加密钱包信息。",
      "current_state_en": "SlowMist warns that the DarkSword-PROV2 trojan is actively exploited to steal iOS Keychain data, files, messages, and crypto wallet information via malicious Safari pages on affected iOS 18.6–18.7.2 and iOS 26.0–26.1 devices.",
      "detailed_summary_zh": "SlowMist warns that the DarkSword-PROV2 trojan is actively exploited to steal iOS Keychain data, files, messages, and crypto wallet information via malicious Safari pages on affected iOS 18.6–18.7.2 and iOS 26.0–26.1 devices.",
      "detailed_summary_en": "SlowMist warns that the DarkSword-PROV2 trojan is actively exploited to steal iOS Keychain data, files, messages, and crypto wallet information via malicious Safari pages on affected iOS 18.6–18.7.2 and iOS 26.0–26.1 devices.",
      "background_zh": "",
      "background_en": "",
      "community_discussion_zh": "",
      "community_discussion_en": "",
      "market_impact_zh": "",
      "market_impact_en": "",
      "importance_score": 7.5,
      "references": [],
      "confidence": 0.75,
      "story_ids": [
        "telegram:foresightnews:120741"
      ],
      "sources": [
        {
          "url": "https://foresightnews.pro/news/h5Detail/115478",
          "label": "foresightnews",
          "source_type": "telegram",
          "official": false
        }
      ]
    },
    {
      "update_id": "upd_50950f357a3d621a",
      "event_id": "evt_5ee68c8adcd5b60d",
      "occurred_at": "2026-10-24T01:11:18Z",
      "published_at": "2026-10-24T01:11:18Z",
      "first_seen_at": "2026-10-24T01:55:29.473773Z",
      "time_precision": "published",
      "update_type": "response",
      "material_change": true,
      "title_zh": "【慢雾：iOS 用户需及时更新系统以防 DarkSword 病毒攻击】",
      "title_en": "【慢雾：iOS 用户需及时更新系统以防 DarkSword 病毒攻击】",
      "what_changed_zh": "慢雾补充建议 iOS 用户及时更新 iPhone/iPad 系统，并警告部分已安装 App 可能遭 DarkSword 投毒；攻击利用 iOS 漏洞突破沙盒。",
      "what_changed_en": "SlowMist additionally advised iOS users to promptly update iPhone/iPad systems and warned that some installed apps may be poisoned by DarkSword; the attack uses iOS vulnerabilities to break sandbox protections.",
      "current_state_zh": "SlowMist 持续警告 DarkSword 针对 iOS 加密货币用户发起攻击，利用 iOS 漏洞突破沙盒，窃取 Keychain 密码、钱包本地私钥和备忘录等数据；并建议用户及时更新 iPhone/iPad 系统、警惕已安装 App 遭投毒。",
      "current_state_en": "SlowMist continues to warn that DarkSword targets iOS crypto users, exploiting iOS vulnerabilities to break sandbox protections and steal Keychain credentials, local wallet private keys, and notes; it advises users to promptly update iPhone/iPad systems and beware poisoned installed apps.",
      "detailed_summary_zh": "SlowMist warns that iOS users should update their systems promptly to defend against the DarkSword malware, which targets crypto users by exploiting iOS vulnerabilities to steal Keychain credentials, wallet private keys, and notes.",
      "detailed_summary_en": "SlowMist warns that iOS users should update their systems promptly to defend against the DarkSword malware, which targets crypto users by exploiting iOS vulnerabilities to steal Keychain credentials, wallet private keys, and notes.",
      "background_zh": "",
      "background_en": "",
      "community_discussion_zh": "",
      "community_discussion_en": "",
      "market_impact_zh": "",
      "market_impact_en": "",
      "importance_score": 7.0,
      "references": [],
      "confidence": 0.9,
      "story_ids": [
        "telegram:foresightnews:121203"
      ],
      "sources": [
        {
          "url": "https://foresightnews.pro/news/h5Detail/115897",
          "label": "foresightnews",
          "source_type": "telegram",
          "official": false
        }
      ]
    }
  ]
}