SlowMist Uncovers Live DarkSword Exploit Infrastructure Targeting iOS Crypto Wallets

Blockchain security firm SlowMist published an analysis detailing the operational backend and distribution infrastructure of the DarkSword iOS exploit chain on Oct. 19, 2026 ¹. The toolkit, which emerged from leaked research repositories, targets iPhones running iOS 18.4 through 18.6.2 to exfiltrate keychain data, credentials, and files primarily associated with three digital wallet applications ¹.

According to SlowMist, the complete DarkSword attack suite was deployed online in late September 2026 after turnkey attack files appeared in a public GitHub repository named DarkSword-PROV2 in July ¹. The deployment utilizes watering-hole decoys—including spoofed luxury watch purchase platforms and fake AI stock analysis tools—to silently trigger exploits when visited via Safari ¹. Google Threat Intelligence Group originally identified the chain on March 18, 2026, noting that it chained six common vulnerabilities and exposures (CVEs), three of which were active zero-days at discovery ¹.

Backend Panel Exposes Victim Telemetry

SlowMist’s analysis of the threat actors' administrative panel uncovered 10,125 theft records and 57 compromised devices across Australia, Malaysia, Latvia, South Korea, Ukraine, Hong Kong, and mainland China ¹. A 30-day tracking funnel within the administrative backend recorded 20,187 page visits and 1,187 exploit attempts, yielding 10 successful compromises and nine confirmed data exfiltration events ¹.

The stolen data categories logged by the backend panel span digital wallets, browser records, SMS messages, and Apple Keychain credentials ¹. Infrastructure tracing revealed that core server nodes had been active since at least November 2025, operating an automated domain-rotation pool that registered delivery domains as recently as October 2026 ¹. The discovery underscores the persistent threat of leaked advanced mobile exploits targeting crypto holders via zero-click or single-visit browser interactions ¹.