SlowMist Report Highlights Threats from DarkSword Trojan Targeting iOS Users

The security organization SlowMist has released a comprehensive threat intelligence report detailing the DarkSword Trojan and its associated attack infrastructure, which poses significant risks to cryptocurrency users. The report outlines the evolution of this malicious software, noting that after exploit code was made public in March 2026, the DarkSword-PROV2 variant surfaced on GitHub in July, with its attack capabilities becoming operational by late September.

SlowMist's analysis reveals that the DarkSword toolkit features a highly automated attack pipeline that encompasses vulnerability delivery, device and data collection, and cryptocurrency wallet fund aggregation. The report emphasizes the extensive data theft capabilities of this toolkit, which specifically targets cryptocurrency wallet data, allowing attackers to decrypt wallet information and aggregate funds. While the toolkit claims compatibility with iOS versions 13 and above, effective exploits are primarily concentrated in the iOS 18.6 to 18.7.2 and iOS 26 to 26.1 versions.

In light of these findings, SlowMist has issued security recommendations for users. It is advised that iOS systems be kept updated and that users avoid clicking on untrusted links, as simply opening a malicious webpage in the Safari browser could exploit vulnerabilities. Users who may have accessed suspicious sites should consider their mnemonic phrases and private keys compromised and should create new wallets to secure their assets. Additionally, users are urged to monitor for unusual transactions and revoke unnecessary token authorizations across various blockchain networks.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News