🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨 A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱 ⚠️ This is a container sandbox escape, not a jailbreak. It breaks the assumption that apps can’t see each other: a malicious app that successfully exploits it can reach system paths and read or modify other apps’ data. 💸 The bug does not steal assets by itself. The real risk starts when a user installs an app from an untrusted source, such as a sideloaded IPA. If a wallet stores its seed phrase, keystore or WebView cache in plaintext locally, a malicious app could read it. 🛡️ Recommendations: 🔸 Don’t install IPAs or apps from unknown sources 🔸 Keep iOS up to date and install Apple’s fix as soon as one is released 🔸 Wallet developers: don’t store sensitive data in plaintext locally 🔸 If you installed an untrusted app on a device holding wallets, treat it as risky and consider moving assets to a new wallet created on a clean device 🔗

🚨 SlowMist TI Alert 🚨 A supply chain attack has compromised Ethersphere’s npm package `@ethersphere/bee-js@13.3.0` and Swarm Desktop v0.56.2. Attackers abused compromised GitHub accounts and legitimate release pipelines to distribute malicious code across Windows, macOS, and Linux. The malicious code retrieves and executes remote JavaScript from `api[.]frameworkmetrics[.]xyz`. Its later-stage backdoor uses the Ethereum smart contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` as a decentralized command-and-control (C2) configuration store, allowing attackers to dynamically update C2 addresses. The same contract was previously linked to the SleepyDuck / EtherDuck malware campaign targeting malicious Open VSX extensions. Potential risks include wallet credential theft, private key exfiltration, persistent backdoor deployment, and unauthorized remote access. Users should remove `@ethersphere/bee-js@13.3.0`, pin version 13.2.0, and upgrade Swarm Desktop to the clean v0.56.3 release. Investigate affected systems, rotate potentially exposed credentials, and monitor suspicious connections to the malicious infrastructure. You can also visit to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! Reference:

🚨 SlowMist TI Alert 🚨 💸 @ankr Loss: ~$304.5k 🔍 Root Cause: The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and withdrawal amounts. All five receipts carried valid signatures from the bridge's trusted consensus signer, allowing withdraw() to release assets without independently verifying the receipts against the actual source-chain events. ⚠️ The origin of the unauthorized signatures remains under investigation. Signer compromise has not been confirmed. 📌 Attacker (Tx Sender): 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703 📌 Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 📌 Vulnerable Contract: 0xc437DF90B37C1dB6657339E31BfE54627f0e7181 Powered by Attack Tx: Reused Source Tx:

🚨 SlowMist TI Alert: Beware of the “Cracked TradingView Premium” Infostealer 🚨 Since mid-October, X account "cryptotrice" has repeatedly promoted a so-called “reverse-engineered cracked #TradingView# Premium,” with some posts passing 300K views. The software requires downloading a password-protected archive and generating a license code via a KeyGen. 🔑 The author claims the project is open source on GitHub, but the download link in the article does not point to #GitHub#. In some replies, the author also said the repo has been made private and that links are only available in-app and expire after a single use. Several users warned in the comments that it looks like malware stealing account info and crypto wallets, and one said their antivirus flagged and deleted it right after extraction. 🦠 We analyzed it and confirmed the Windows sample is an infostealer: 🔸 Collects browser credentials, crypto wallet data and Telegram data, and sends it to the C2 via WinINet 🔸 Uses Telegram and Steam to dynamically fetch and rotate C2 servers 🔸 The download site, arche-hypnose[.]com, appears to be a legitimate website compromised to distribute the malware 🔸 The macOS link currently returns 404, so no sample has been obtained ⚠️ If you have already run this software: disconnect from the network immediately, move your assets to a clean device with a new wallet and seed phrase, change passwords for your browsers, exchanges, email and Telegram, and terminate active Telegram sessions. Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them. 🛡️ IOC Sample source: teapawt[.]org/cryptotrice/article/2111472920241524897 Download links: hxxps://www[.]arche-hypnose[.]com/get/ (Windows) hxxps://www[.]arche-hypnose[.]com/mac/ (macOS, currently 404) C2: hxxps://xn[.]amanlay[.]org/rn/gate hxxps://z[.]dak69[.]org/j/gate hxxps://xn[.]amanlay[.]org/kw/gate

Dirty money isn’t only caught once it reaches an exchange. On-chain fund flows are traceable by nature. Before accepting funds from an unfamiliar address, or from a “friend” or “relative,” check the address on MistTrack first. You’ll see its risk score, associated labels, and upstream/downstream fund paths, so you can spot fraud- or laundering-related risk early. A check takes a minute. A freeze can take months to resolve. 👉

🚨 The U.S. Treasury’s OFAC has sanctioned 10 individuals and one entity linked to #DPRK# IT worker networks. SlowMist used @MistTrack_io to analyze the listed crypto addresses and uncovered several on-chain connections: 🔎 Boykov ↔ Obertas • OFAC listed the same #Ethereum# address under both individuals. • Boykov transferred approximately $9.88M to this address. Two of his #TRON# addresses also sent a combined 1.66M $USDT to an address attributed to Obertas. 🔎 Boykov ↔ Kim Ki Hyok • Both had Ethereum addresses sending funds to the same #Bybit# deposit address: Boykov: ~$4M Kim Ki Hyok: 50,000 $DAI The risks posed by DPRK IT workers go beyond financial activities. Using false identities, they may gain access to company devices, internal systems, and sensitive data. ⚠️ Companies should verify worker identities, monitor the use of company devices, and carefully manage system access. 📖 Read the full analysis:

🚨 SlowMist TI Alert: Android’s November 2026 security bulletin is out 🚨 Among the critical flaws: CVE-2026-58868 (Critical) in the Framework component. 💥 It allows remote code execution with no user interaction and no extra privileges. 📱 Affects Android 14, 15, 16, 16-QPR2 and 17. 🔍 No confirmed in-the-wild exploitation so far. But if a bug like this ever gets exploited at scale, it would be a nuke for mobile. Android runs on roughly 7 out of every 10 smartphones worldwide. 🌍 🛡️ Patch levels: ✅ 2026-11-01+: includes CVE-2026-58868 and other Framework/System fixes ✅ 2026-11-05+: covers ALL fixes this month, incl. kernel, MediaTek & Qualcomm ⚙️ Check: Settings → About phone → Android version → Security patch level Please update ASAP ⬆️ 📄 Details:

Congratulations to @Changer_Plus on successfully completing its smart contract security audit by SlowMist! 🎉 Thanks to Changer+ for choosing SlowMist as its security partner! 👏 🔗 Audit Report:

🚨 On October 29, 2026, cross-chain protocol @zkLink_Official was exploited for approximately $783K. The SlowMist Security Team analyzed the incident and uncovered how a transient storage flaw led to forged batch roots and unauthorized withdrawals. 🧩 Attack Flow: 1️⃣ Queried totalBatchesExecuted and selected the next batch (116409) for forgery. 2️⃣ Executed a genuine Linea claim through SyncL2TxHashRelayer, writing finalizeMessageHash into transient storage. 3️⃣ Reused the stale finalizeMessageHash in a second claimMessage call, triggering an attacker-controlled call to EthereumGateway. 4️⃣ Used EthereumGateway.sendMessage to call ZkLink.syncBatchRoot, forging the batch root and advancing totalBatchesExecuted. 5️⃣ Executed 12 withdrawals against the forged root: 1 ETH and 11 ERC-20 transfers using forged Merkle proofs. ⚙️ Root Cause: Arbitrator.claimMessage allows relayers to specify arbitrary call targets and calldata, while failing to clear or bind finalizeMessageHash to the current invocation. Combined with ZkLink.syncBatchRoot only checking gateway identity without verifying batch proofs, this enabled batch root forgery. 🔒 Recommendations: When reviewing similar cross-chain relayer projects, pay attention to four areas: 1️⃣ Reset transient storage before each call. 2️⃣ Bind verification values to the current invocation. 3️⃣ Check whether arbitrary users can indirectly leverage trusted callers through public helper contracts or relayers. 4️⃣ Independently verify batch root updates rather than relying solely on caller identity. Full analysis 👇

🔥 Agenda Released | 2026 HK Institutional RWA & Stablecoin Forum On Nov 2, SlowMist and JunHe LLP will host a closed-door summit in Hong Kong to explore #RWA# implementation, stablecoin payments, and institutional security and risk management. 🎤 Keynote Sessions 🔹 Keywolf (Partner & CPO, SlowMist): Security defense and #AML# screening in the AI era 🔹 Jacqueline Qiao @CryptoQiao (Partner, JunHe LLP): Licensing and compliance for virtual assets and stablecoin payments in Hong Kong 💬 Key Discussion Topics 🔸 RWA tokenization and on-chain product development 🔸 Cross-border payments and financial services 🔸 On-chain incident response, fund tracing and recovery Industry professionals from diverse sectors will come together for roundtable discussions. 📅 Nov 2 | 14:00–18:30 (GMT+8) 📍 AIA Central, Hong Kong 🙋 Register: See you in Hong Kong! 👋

🚨 Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses @SlowMist_Team recently detected an attack involving malicious code injected into scripts associated with the #Udesk# customer service system during routine threat intelligence investigations. We obtained and analyzed two #JavaScript# samples to trace how the malicious code was loaded into webpages and executed. 🔍 Further analysis revealed two key malicious behaviors: 🔹 The malicious script collects cookies, localStorage, sessionStorage, and sensitive information submitted through forms and authentication requests, potentially exposing user sessions and account credentials. 🔹 The script replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially redirecting deposits to substituted recipient addresses. MistEye ( SlowMist’s Web3 threat intelligence system, promptly disseminated the relevant risk information through its intelligence push and customer alert channels.🫡 🛡️ Recommendations: Stop serving compromised scripts and restore trusted versions. Investigate data exfiltration records, revoke potentially exposed sessions, and rotate potentially exposed credentials from a clean environment. Independently verify deposit addresses and transaction records through trusted channels. Read the full analysis 👇

As #RWA# tokenization and stablecoin payments move into broader financial use cases, institutions face growing challenges in compliance, fund risk, and security. On Nov 2, during Hong Kong FinTech Week, SlowMist × JunHe LLP will host the closed-door summit “Legal Breakthrough, Risk Foundation | 2026 Hong Kong RWA & #Stablecoin# Payments Institutional Summit.” Discussion topics include: ✅ RWA issuance & distribution workflows ✅ Stablecoin payments & cross-border settlement ✅ On-chain risk monitoring & emergency response 📅 Nov 2, 2026 | 14:00–18:30 (GMT+8) 📍 AIA Central, Central, Hong Kong 🙋 Register: We sincerely welcome senior executives and decision-makers from relevant institutions to join us! 👋

🚨SlowMist TI Alert🚨 💸 Yapeswap Loss: ~$21.9k 🔍 Root Cause: WorkersUnion’s zero quorum let a proposal backed by ~0.000055% of voting power transfer YapeFactory’s `feeToSetter` role to the attacker. The attacker installed a Registry that returned fake vaults from `latestVault()` while `vaults()` still listed real ones. YapePair counted the diverted deposits as farming assets without receiving redeemable shares. 📌 Attacker: 0x6e523866424220b3cb2cab88ba2195cfa5636b12 (EOA) / 0x327bf6dfc38a79393f78866c705193c39b04be01 (contract) 📌 Victim: YapePair contracts (e.g. 0x23c1653e…, 0x670120d4…, 0x8e5b9d85…, 0xe3b43be5…, 0xec5ed926…, 0x0415af9f…) 📌 Vulnerable Contract: YapeFactory / YapePair / YapeWrapper (0x46adc1c052fafd590f56c42e379d7d16622835a2) Powered by Tx:

🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users ⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword#. DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk. 🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges. 🛡️ Stay safe: • Keep your iOS devices updated. • Be cautious of suspicious or compromised apps. • Never store sensitive wallet credentials or seed phrases in Notes. 📖 Related SlowMist analyses: 🔗 DarkSword Trojan Backend & iOS Attack Chain: 🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:

🚨 Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor @SlowMist_Team recently received user reports about a GitHub repository named sol-live, presented as a #Solidity# interview practice project. Analysis revealed a hidden download-and-execute command in .vscode/settings.json that can run a remote script when the project's custom terminal configuration is launched. 🔍 The retrieved payload contains three main modules capable of: 🔹 Collecting browser login databases and wallet extension storage, and copying #macOS# Keychain files 🔹 Scanning and uploading local files 🔹 Executing remote commands, providing interactive shell access, and monitoring clipboard contents ⚠️ On macOS/Linux, execution requires users to actively launch the malicious terminal configuration. The #Windows# execution chain remains unconfirmed due to potential quoting issues. We also identified 8 other #GitHub# projects with similar terminal-based download-and-execute techniques. The analysis does not confirm the actual scope of infection or whether data was exfiltrated. 🛡️ Recommendations: Review .vscode/settings.json and terminal launch arguments before using untrusted projects. If execution is confirmed or cannot be ruled out, isolate and investigate the affected host, then migrate wallet assets and rotate relevant credentials from a trusted device. Read the full analysis 👇