Current outcome
SlowMist continues to warn that DarkSword targets iOS crypto users, exploiting iOS vulnerabilities to break sandbox protections and steal Keychain credentials, local wallet private keys, and notes; it advises users to promptly update iPhone/iPad systems and beware poisoned installed apps.
Progress timeline
2 material updates- #01
【慢雾：DarkSword 木马已被投入实际攻击，部分 iOS 26 版本也受影响】
SlowMist warns that the DarkSword-PROV2 trojan is actively exploited to steal iOS Keychain data, files, messages, and crypto wallet information via malicious Safari pages on affected iOS 18.6–18.7.2 and iOS 26.0–26.1 devices.
Source evidence: foresightnews
- #02
【慢雾：iOS 用户需及时更新系统以防 DarkSword 病毒攻击】
SlowMist additionally advised iOS users to promptly update iPhone/iPad systems and warned that some installed apps may be poisoned by DarkSword; the attack uses iOS vulnerabilities to break sandbox protections.
State after update: SlowMist continues to warn that DarkSword targets iOS crypto users, exploiting iOS vulnerabilities to break sandbox protections and steal Keychain credentials, local wallet private keys, and notes; it advises users to promptly update iPhone/iPad systems and beware poisoned installed apps.
Source evidence: foresightnews