SlowMist Tracking Wave of Advanced Credential and Wallet Exploits

Where things stand

Blockchain security firm SlowMist is tracking an escalating series of sophisticated attack vectors targeting cryptocurrency users across software development, customer support, and mobile infrastructure.

Most recently, SlowMist detected malicious code injected into Udesk customer support scripts. Attackers tampered with the scripts to capture user credentials, siphon session tokens, and swap cryptocurrency deposit addresses directly during transactions.

This incident follows two other operational threats identified by the firm in late October 2026. Earlier findings detailed a malicious Solidity coding assessment repository that deployed hidden scripts through VS Code settings to pilfer macOS Keychain files and digital wallet data. Prior to that, SlowMist identified active infrastructure tied to DarkSword, a leaked zero-day exploit chain deployed in late September that targeted iOS devices to extract wallet files, credentials, and keychain stores.

Why it matters

The threat landscape is increasingly shifting toward supply-chain tampering and ecosystem touchpoints, moving beyond on-chain smart contract bugs to compromise developers, platform support tooling, and end-user hardware directly.

What happens next

Security teams are continuing investigations into the scope of compromised Udesk endpoints and the distribution networks leveraging the DarkSword toolset and malicious repositories.