DarkSword iPhone Exploit Repackaged to Steal Crypto Wallets
SlowMist says the DarkSword iOS exploit chain has been repackaged as a deployable spyware framework targeting iPhone users and cryptocurrency wallets. Code appeared on GitHub in March, and researchers observed attack infrastructure operating from late September. The related DarkSword-PROV2 project reportedly includes exploit code, a delivery server, an administrative panel, a database and theft modules targeting imToken, TokenPocket and TronLink wallets. Its documentation offered a full version for 5,000 USDT.
The framework can reportedly be triggered when a user visits a malicious page in Safari. Although the system accepts devices from iOS 13 onward and its library contains more than 1,000 payload entries, SlowMist says the complete exploit chains currently supported by the attackers’ routing code target iOS 18.6–18.7.2 and iOS 26.0–26.1. Broad device labels do not establish that every version can be compromised.
In one 30-day period, the control panel recorded 20,187 page visits and 1,187 exploit attempts, with 10 reported successes and data exfiltration in nine cases. SlowMist also reported 57 logged devices across multiple regions. Separately, the exposed panel showed 6,115 visits, 10,125 theft records and 143,802 iOS logs; these figures come from a different reporting context and should not be combined with the 30-day funnel. No victim financial losses were disclosed. SlowMist advises anyone who visited a suspicious page to treat wallet keys and seed phrases as potentially exposed, move funds to a new wallet created on a clean device, and review and revoke unnecessary token approvals. The DarkSword case highlights the risk of public iOS exploits being adapted for crypto wallet theft.
Neutral
This is a serious cybersecurity threat, but the reports do not identify a specific cryptocurrency whose fundamentals, supply or demand have changed. The incident could prompt short-term caution among crypto traders and wallet users, particularly around assets held in affected wallets, and may cause isolated selling if individual losses emerge. However, no victim losses were disclosed, and there is no evidence of a broad market disruption or a direct price catalyst for USDT, TRX or other tokens associated with the named wallet platforms. Over the longer term, greater security awareness and wallet migration could affect usage patterns, but the exploit alone does not establish a sustained direction for token prices. The expected direct price impact on the mentioned cryptocurrencies is therefore neutral.