🚨 Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain Following the public release of #DarkSword-related# exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, with the attack infrastructure observed operating online in late September. We traced the live attack infrastructure, linked its admin panels to public GitHub repositories, and analyzed the exploit code, payload library, delivery chain, and post-exploitation capabilities. 🔍 Key Findings: 🔹 A complete attack pipeline: The infrastructure integrates exploit delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation. 🔹 Extensive data theft capabilities: The toolkit targets Keychain data, files, messages, and crypto wallet data, with additional capabilities for wallet data decryption and fund consolidation. 🔹 Broader claimed coverage, narrower functional coverage: Although the toolkit claims support for iOS 13 and later, code analysis identifies two functional exploit windows: iOS 18.6–18.7.2 and iOS 26.0–26.1. Many other version entries remain incomplete or unverified. 🔹 Public code weaponized: Publicly available exploit components have been integrated into a deployable attack framework, lowering the barrier to launching sophisticated #iOS# attacks. 🛡️ Recommendations Keep iOS updated and avoid untrusted links. Simply opening a malicious page in #Safari# may trigger exploitation. If a device has visited a suspicious landing page, treat its seed phrases and private keys as potentially compromised. Use a device that has never accessed the page to create a new wallet and transfer your assets. Also check for abnormal transactions and token approvals across chains, and revoke unnecessary approvals. 🔗 Read the full analysis:

🚨 Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft SlowMist Security Team identified a campaign masquerading as a free VPS service. The landing page at event[.]polarnode[.]vip is a decoy that silently loads lk[.]js and screens for iPhone Safari on iOS 18.4–18.6.2. Matching devices receive a hidden iframe (/dist/sandbox.html) that launches a multi-stage n-day chain reusing the DarkSword six-CVE chain: WebKit RCE, GPU / mediaplaybackd sandbox escapes, and kernel read/write. Post-exploitation injects three plugins: 🔹 SpringBoard (sync.js) — recursively collects files from app containers, shared AppGroups, or absolute paths 🔹 securityd (auth.js) — collects genp / inet data from Keychain 🔹 kbd (input.js) — captures keyboard input when imToken, TokenPocket, or TronLink is in the foreground MistEye reconstructed the delivery path and extracted C2, loader, and implant IOCs. When GTIG first observed DarkSword, three of the six CVEs were zero-days in the wild. By September 2026, all six had been publicly disclosed and patched by Apple, making the current delivery an n-day reuse of the DarkSword six-CVE chain. ❗️A page visit alone does not prove seed phrase or private key theft — confirm with device forensics first. A free VPS page that only wants Safari on a narrow iOS range is not a VPS page. Update to iOS / iPadOS 18.7.3 or 26.3+, and block / / port 36887. Read the full analysis 👇

DAY 349 // FULL POSITION BREAKDOWN Market check. BTC $82,188.23, up 0.81% on the day. ETH $2,441.36, up 0.73% on the day. Fear and Greed at 51. Total market cap $2.76T, up 0.63%. TRADING @HyperliquidX Position: ETHFI 3x, margin $278.86, up $191.55. Position: BTC 7x, margin $28.17, up $1.61. Up $54.88 from yesterday. @pendle_fi Value $578.56. Down $9.79 from yesterday. @boros_fi Wallet 1: $2,660. Wallet 2: $1,294. Total $3,954. Down $44 from yesterday. @Variational_io Position: JUP, up $135.42. Position: PONS, down $443.91. Total down $308.49. Up $37.14 from yesterday. @Lighter_xyz Position: PENDLE 3x, margin $1,601.36, up $305.34. Position: SOL 3x, margin $343.37, up $11.69. Position: ETH 4x, margin $19.79, down $0.85. Total $316.18. Down $20.67 from yesterday. @PhoenixTrade Position: LIT long closed. My stop loss was filled, a loss of around $60. It was a test trade to try their tools and see how leverage works. Great UI. TRADING PnL: Total $200.85 / Value $4,532.43 FUNDING RATE ARB @zyphex Value $8,036.35. Position: hedges across multiple exchanges, funding today -$1.60. Funding rates were very volatile today. Up $4.71 from yesterday. FUNDING RATE ARB PnL: Value $8,036.35 / Funding today -$1.60 LIQUIDITY PROVISION @DeFiTuna Value $743.92. Up $25.09 from yesterday. @prjx_buddy Position: WHYPE/USDC, $3,208.11. Up $7.28 from yesterday. @Uniswap Position: NFLX/USDG, $1,011.50. Position: PENDLE/WETH, $1,505.82. Value $2,517.32. Up $32.33 from yesterday. @byreal_io Value $2,836.73. Up $47.04 from yesterday. @protocol_fx Vesting cvxFXN and FXN rewards. Value $743.11. Up $25.21 from yesterday. @ConvexFinance Staked cvxFXN. Value $382.35. Up $12.92 from yesterday. LIQUIDITY PROVISION PnL: Value $10,431.54 The edge isn't in the trade. It's in the wait. 🥂 DarkLord_gr Out.

DAY 348 // FULL POSITION BREAKDOWN Market check. BTC $81,875.26, down 1.51% on the day. ETH $2,429.34, down 3.01% on the day. Fear and Greed at 51. Total market cap $2.75T, down 1.76%. TRADING @HyperliquidX Position: ETHFI 3x, margin $256.58, up $138.18. Position: BTC 7x, margin $22.47, up $0.10. Down $69.16 from yesterday. @pendle_fi Value $588.35. Down $0.33 from yesterday. @boros_fi Wallet 1: $2,670. Wallet 2: $1,328. Total $3,998. Down $29 from yesterday. @Variational_io Position: JUP, up $258.45. Position: PONS, down $604.08. Total down $345.63. Up $60.64 from yesterday. @Lighter_xyz Position: PENDLE 3x, margin $1,598.97, up $337.87. Position: SOL 3x, margin $323.43, up $0.22. Position: ETH 4x, margin $19.80, down $1.24. Total $336.85. Down $118.18 from yesterday. @PhoenixTrade Position: LIT long 7.6x, value $150.65, down $58.57. Down $11.97 from yesterday. Leverage moved from 5.1x to 7.6x. TRADING PnL: Total $70.93 / Value $4,586.61 FUNDING RATE ARB @zyphex Value $8,031.64. Position: hedges across multiple exchanges, funding today +$6.73. Up $1.58 from yesterday. FUNDING RATE ARB PnL: Value $8,031.64 / Funding today +$6.73 LIQUIDITY PROVISION @DeFiTuna Value $718.83. Down $42.78 from yesterday. @prjx_buddy Position: WHYPE/USDC, $3,200.83. Up $2.84 from yesterday. @Uniswap Position: NFLX/USDG, $983.45. Position: PENDLE/WETH, $1,501.54. Value $2,484.99. Down $43.42 from yesterday. @byreal_io Value $2,789.69. Down $64.82 from yesterday. @protocol_fx Vesting cvxFXN and FXN rewards. Value $717.90. Down $14.66 from yesterday. @ConvexFinance Staked cvxFXN. Value $369.43. Down $7.22 from yesterday. LIQUIDITY PROVISION PnL: Value $10,281.67 The edge isn't in the trade. It's in the wait. 🥂 DarkLord_gr Out.