727 FinancePANews October 19 news: SlowMist has released an analysis of the DarkSword trojan's backend and iOS attack chain. In March 2026, exploit code related to DarkSword was publicly disclosed; in July of the same year, DarkSword-PROV2 appeared on GitHub; in late September, researchers discovered that its attack infrastructure had been put into actual operation. SlowMist tracked this attack infrastructure, linked its management backend to the public GitHub repository, and conducted an in-depth analysis of its exploit code, payload library, delivery chain, and post-compromise capabilities.
The infrastructure integrates exploit delivery, device and data collection, data exfiltration, and cryptocurrency wallet fund consolidation functions; although the toolkit claims to support iOS 13 and later, code analysis shows that its exploit functionality actually covers only two ranges: iOS 18.6–18.7.2 and iOS 26.0–26.1.
SlowMist recommends updating the iOS system promptly and avoiding clicking unknown links. If a device has visited a suspicious landing page, it should be assumed that the mnemonic/private key may have been compromised; use a device that has never visited that page to create a new wallet and transfer assets; at the same time, check for abnormal transactions and cross-chain approvals, and promptly revoke unnecessary approvals.