---
title: "SlowMist Uncovers Live DarkSword Exploit Infrastructure Targeting iOS Crypto Wallets"
description: "A leaked zero-day exploit chain deployed in late September targeted iOS devices to extract cryptocurrency wallet files, keychain data, and credentials."
url: https://basisdesk.news/news/slowmist-darksword-ios-exploit-analysis
published: 2026-10-19T11:06:39.523Z
modified: 2026-10-19T11:06:39.523Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: []
tags: [security, ios, exploits, slowmist, crypto-wallets]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# SlowMist Uncovers Live DarkSword Exploit Infrastructure Targeting iOS Crypto Wallets

A leaked zero-day exploit chain deployed in late September targeted iOS devices to extract cryptocurrency wallet files, keychain data, and credentials.

## At a glance

- **What happened:** SlowMist analyzed live administrative infrastructure for the DarkSword iOS exploit chain targeting cryptocurrency wallet credentials.
- **Why it matters:** The turnkey exploit package allows threat actors to silently extract wallet keys and passwords simply by luring victims to decoy web pages.
- **Who is affected:** Users of iOS versions 18.4 through 18.6.2 utilizing mobile cryptocurrency wallets.
- **What's next:** No next step announced
- **Primary source:** [Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain](https://slowmist.medium.com/threat-intelligence-analysis-of-the-darksword-trojan-backend-and-ios-attack-chain-397ecf499fa8?source=rss-4ceeedda40e8------2) — SlowMist

## Key points

- SlowMist identified live infrastructure running the DarkSword iOS exploit chain targeting crypto wallet apps, keychain data, and input logs.
- The attack targets iOS 18.4 to 18.6.2 via Safari pages, utilizing six CVEs including three former zero-days.
- Administrative dashboard data revealed 10,125 theft records across 57 compromised devices globally.

## Editorial remark

- **Context:** DarkSword was disclosed by Google Threat Intelligence in March 2026 before fully functional deployment packages leaked onto public code repositories like GitHub in July 2026.
- **Impact:** iPhone users visiting compromised or decoy websites risk automatic exploitation and theft of on-device crypto wallet credentials and private keychain data.
- **Watch:** Subsequent patch verifications from Apple and domain takedowns coordinated against the threat actors' rotating hosting infrastructure.

Blockchain security firm SlowMist published an analysis detailing the operational backend and distribution infrastructure of the DarkSword iOS exploit chain on Oct. 19, 2026 [1]. The toolkit, which emerged from leaked research repositories, targets iPhones running iOS 18.4 through 18.6.2 to exfiltrate keychain data, credentials, and files primarily associated with three digital wallet applications [1].

According to SlowMist, the complete DarkSword attack suite was deployed online in late September 2026 after turnkey attack files appeared in a public GitHub repository named DarkSword-PROV2 in July [1]. The deployment utilizes watering-hole decoys—including spoofed luxury watch purchase platforms and fake AI stock analysis tools—to silently trigger exploits when visited via Safari [1]. Google Threat Intelligence Group originally identified the chain on March 18, 2026, noting that it chained six common vulnerabilities and exposures (CVEs), three of which were active zero-days at discovery [1].

## Backend Panel Exposes Victim Telemetry

SlowMist’s analysis of the threat actors' administrative panel uncovered 10,125 theft records and 57 compromised devices across Australia, Malaysia, Latvia, South Korea, Ukraine, Hong Kong, and mainland China [1]. A 30-day tracking funnel within the administrative backend recorded 20,187 page visits and 1,187 exploit attempts, yielding 10 successful compromises and nine confirmed data exfiltration events [1].

The stolen data categories logged by the backend panel span digital wallets, browser records, SMS messages, and Apple Keychain credentials [1]. Infrastructure tracing revealed that core server nodes had been active since at least November 2025, operating an automated domain-rotation pool that registered delivery domains as recently as October 2026 [1]. The discovery underscores the persistent threat of leaked advanced mobile exploits targeting crypto holders via zero-click or single-visit browser interactions [1].

## Sources

1. [Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain](https://slowmist.medium.com/threat-intelligence-analysis-of-the-darksword-trojan-backend-and-ios-attack-chain-397ecf499fa8?source=rss-4ceeedda40e8------2) — SlowMist, 2026-10-19

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai