🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users ⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword#. DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk. 🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges. 🛡️ Stay safe: • Keep your iOS devices updated. • Be cautious of suspicious or compromised apps. • Never store sensitive wallet credentials or seed phrases in Notes. 📖 Related SlowMist analyses: 🔗 DarkSword Trojan Backend & iOS Attack Chain: 🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:

🚨 Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain Following the public release of #DarkSword-related# exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, with the attack infrastructure observed operating online in late September. We traced the live attack infrastructure, linked its admin panels to public GitHub repositories, and analyzed the exploit code, payload library, delivery chain, and post-exploitation capabilities. 🔍 Key Findings: 🔹 A complete attack pipeline: The infrastructure integrates exploit delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation. 🔹 Extensive data theft capabilities: The toolkit targets Keychain data, files, messages, and crypto wallet data, with additional capabilities for wallet data decryption and fund consolidation. 🔹 Broader claimed coverage, narrower functional coverage: Although the toolkit claims support for iOS 13 and later, code analysis identifies two functional exploit windows: iOS 18.6–18.7.2 and iOS 26.0–26.1. Many other version entries remain incomplete or unverified. 🔹 Public code weaponized: Publicly available exploit components have been integrated into a deployable attack framework, lowering the barrier to launching sophisticated #iOS# attacks. 🛡️ Recommendations Keep iOS updated and avoid untrusted links. Simply opening a malicious page in #Safari# may trigger exploitation. If a device has visited a suspicious landing page, treat its seed phrases and private keys as potentially compromised. Use a device that has never accessed the page to create a new wallet and transfer your assets. Also check for abnormal transactions and token approvals across chains, and revoke unnecessary approvals. 🔗 Read the full analysis:

🚨 Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft SlowMist Security Team identified a campaign masquerading as a free VPS service. The landing page at event[.]polarnode[.]vip is a decoy that silently loads lk[.]js and screens for iPhone Safari on iOS 18.4–18.6.2. Matching devices receive a hidden iframe (/dist/sandbox.html) that launches a multi-stage n-day chain reusing the DarkSword six-CVE chain: WebKit RCE, GPU / mediaplaybackd sandbox escapes, and kernel read/write. Post-exploitation injects three plugins: 🔹 SpringBoard (sync.js) — recursively collects files from app containers, shared AppGroups, or absolute paths 🔹 securityd (auth.js) — collects genp / inet data from Keychain 🔹 kbd (input.js) — captures keyboard input when imToken, TokenPocket, or TronLink is in the foreground MistEye reconstructed the delivery path and extracted C2, loader, and implant IOCs. When GTIG first observed DarkSword, three of the six CVEs were zero-days in the wild. By September 2026, all six had been publicly disclosed and patched by Apple, making the current delivery an n-day reuse of the DarkSword six-CVE chain. ❗️A page visit alone does not prove seed phrase or private key theft — confirm with device forensics first. A free VPS page that only wants Safari on a narrow iOS range is not a VPS page. Update to iOS / iPadOS 18.7.3 or 26.3+, and block / / port 36887. Read the full analysis 👇

🔐 Security Advisory for iOS Users Security researchers have identified two exploit kits targeting older iOS versions: Coruna and DarkSword. Please keep your iOS updated to stay safe. ⚠️ These attacks target iOS system vulnerabilities and are unrelated to wallet apps themselves. ▪️ Coruna (iOS 13.0–17.2.1): Can exploit iOS vulnerabilities through malicious websites to steal sensitive data, including wallet information. ▪️ DarkSword (iOS 18.4–18.7): Can exploit iOS vulnerabilities through malicious websites to bypass system protections and steal sensitive data. 🛡️ How to stay safe: 1️⃣ Update to the latest available version. 2️⃣ If you can't update yet, enable Lockdown Mode for extra protection. 3️⃣ Avoid suspicious or untrusted websites. 4️⃣ Never store recovery phrases or private keys in screenshots or notes apps. 5️⃣ For large holdings, consider a @KeyPalWallet hardware wallet. Stay updated. Stay SAFU.

🟦 TokenPocket Weekly 🚀 Product • Android 2.31.0 is live — multi-language mnemonics, optimized Meme Mode & improved UX. • Gas-free stablecoin transfers continue across multiple networks. 🔐 Security • iOS Security Alert: Coruna & DarkSword target older iOS versions. Update iOS, avoid suspicious links & protect your recovery phrases. • EIP-7702: Recent CEX incident stemmed from internal signing abuse, not the standard itself. Use TokenPocket’s Approval Detector to stay safe. 🌐 Community • October Monthly Report released — covering product upgrades, payments & security. • Halloween Treats winners announced — KeyPal 2 & USDT rewards distributed! Trade. Pay. Secure. All in TokenPocket.

If your iPhone or another iOS device is still running iOS 26.2 or an earlier iOS 26 release, pay attention. DarkSword is a powerful iOS exploit chain. Researchers have confirmed attacks targeting iOS 18.4 through 18.7.2, and some of the underlying vulnerabilities remained unpatched in iOS 26.2. The final fix only arrived with iOS 26.3. If your device is vulnerable and you happen to visit a malicious website exploiting DarkSword, this is pretty much what your iPhone could look like to an attacker. We’re talking about system level exploitation. Once an attacker gains sufficient privileges, the impact can extend far beyond the app where the attack started. Even if App A is the initial entry point, sensitive data in App B could also be exposed, including your crypto wallets. Be careful which apps you install and which links you open. Always update to the latest iOS version available for your device. If you’re staying on iOS 26, make sure you’re on at least 26.3. If you’re still on iOS 18, update to 18.7.7 or later. If you can’t update immediately, especially if you’re using an iPhone as a cold wallet or have multiple software wallets installed, such as MetaMask, Phantom, or others, I strongly recommend enabling Lockdown Mode. Here’s how: - Open Settings. - Go to Privacy & Security. - Scroll down and tap Lockdown Mode. - Tap Turn On Lockdown Mode, then Turn On & Restart. - Enter your passcode to confirm. Lockdown Mode will restrict certain features, but that’s a reasonable tradeoff when you’re storing significant crypto assets on your phone. And please remember, Lockdown Mode is no substitute for security updates. Keep your devices patched.

Updating to the latest iOS is important to enhance your wallet's security Your wallet runs on your phone’s operating system, so its security depends on that system being protected. When security flaws are found in iOS, Apple fixes them through software updates. However, devices that haven’t installed those updates stay exposed to the known flaws. Recently, security researchers have identified two exploit kits, Coruna and DarkSword, which target devices on older iOS versions. These kits exploit flaws in iOS itself. They don’t rely on a flaw in any wallet app, but once a device is compromised they can access wallet data stored on it. Affected versions: - Coruna (iOS 13.0–17.2.1): Uses malicious websites to take advantage of iOS vulnerabilities and access sensitive information, including wallet data. - DarkSword (iOS 18.4–18.7): Uses malicious websites to get around built-in iOS security protections and access sensitive information. Steps to reduce your risk: 1️⃣ Update to the most recent iOS version available for your device. 2️⃣ If updating isn’t possible right now, turn on Lockdown Mode for an added layer of security. 3️⃣ Stay away from unfamiliar or untrusted websites. 4️⃣ Keep your recovery phrase and private keys out of screenshots and notes apps.

DAY 349 // FULL POSITION BREAKDOWN Market check. BTC $82,188.23, up 0.81% on the day. ETH $2,441.36, up 0.73% on the day. Fear and Greed at 51. Total market cap $2.76T, up 0.63%. TRADING @HyperliquidX Position: ETHFI 3x, margin $278.86, up $191.55. Position: BTC 7x, margin $28.17, up $1.61. Up $54.88 from yesterday. @pendle_fi Value $578.56. Down $9.79 from yesterday. @boros_fi Wallet 1: $2,660. Wallet 2: $1,294. Total $3,954. Down $44 from yesterday. @Variational_io Position: JUP, up $135.42. Position: PONS, down $443.91. Total down $308.49. Up $37.14 from yesterday. @Lighter_xyz Position: PENDLE 3x, margin $1,601.36, up $305.34. Position: SOL 3x, margin $343.37, up $11.69. Position: ETH 4x, margin $19.79, down $0.85. Total $316.18. Down $20.67 from yesterday. @PhoenixTrade Position: LIT long closed. My stop loss was filled, a loss of around $60. It was a test trade to try their tools and see how leverage works. Great UI. TRADING PnL: Total $200.85 / Value $4,532.43 FUNDING RATE ARB @zyphex Value $8,036.35. Position: hedges across multiple exchanges, funding today -$1.60. Funding rates were very volatile today. Up $4.71 from yesterday. FUNDING RATE ARB PnL: Value $8,036.35 / Funding today -$1.60 LIQUIDITY PROVISION @DeFiTuna Value $743.92. Up $25.09 from yesterday. @prjx_buddy Position: WHYPE/USDC, $3,208.11. Up $7.28 from yesterday. @Uniswap Position: NFLX/USDG, $1,011.50. Position: PENDLE/WETH, $1,505.82. Value $2,517.32. Up $32.33 from yesterday. @byreal_io Value $2,836.73. Up $47.04 from yesterday. @protocol_fx Vesting cvxFXN and FXN rewards. Value $743.11. Up $25.21 from yesterday. @ConvexFinance Staked cvxFXN. Value $382.35. Up $12.92 from yesterday. LIQUIDITY PROVISION PnL: Value $10,431.54 The edge isn't in the trade. It's in the wait. 🥂 DarkLord_gr Out.