Slow Fog Releases DarkSword Trojan Analysis Report: Public Code Weaponized, iOS Crypto Wallets Face Threats

On October 19, a security agency released an in-depth threat intelligence report on the DarkSword Trojan backend and iOS attack chain. The report tracked the evolution of the attack infrastructure and revealed its high danger level targeting cryptocurrency asset users.

Analysis shows that since the public disclosure of the related exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be operational by late September. The team not only tracked its online infrastructure but also linked its management panel to the publicly available GitHub repository, dissecting the exploit code, delivery chain, and post-compromise capabilities. The report highlighted several key findings of this attack framework:

• A highly automated complete attack pipeline that integrates vulnerability delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation functions.

• Extensive and deep data theft capabilities; this toolkit targets not only Keychain, files, and information but also specifically cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds.

• Although the toolkit claims to support iOS 13 and above, code analysis confirms that its actual effective exploit window is concentrated in the iOS 18.6--18.7.2 and iOS 26.0--26.1 version ranges.

• The publicly available vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the threshold for launching complex iOS attacks.

In response to this threat, clear security recommendations have been provided. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser could trigger vulnerabilities. If a device has accessed suspicious landing pages, users should consider their mnemonic phrases and private keys compromised, and must create new wallets and transfer assets using a clean device that has never accessed those pages. Additionally, users should thoroughly check for abnormal transactions and token authorizations across chains and immediately revoke unnecessary authorizations.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.