Live · updated 8 minutes ago · 36 stories in 24h

← Stream
Hacks & Security Unverified First seen

SlowMist alerts on DarkSword malware targeting iPhone crypto users

SlowMist's threat intelligence team issued an alert that a campaign called DarkSword targets crypto users on iPhone and iPad, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data. SlowMist's MistEye analysis identified 1,500+ DarkSword-related phishing sites across e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services and exchanges. SlowMist advised users to update iOS, be cautious of suspicious apps, and avoid storing wallet credentials or seed phrases in Notes.

Why “Unverified”

  • Reported by SlowMist alone, with no second source or primary confirmation yet

1 independent source group across 1 post · evidence score 72/100. How labels work

What the sources claim

  1. SlowMist says DarkSword exploits iOS vulnerabilities to escape the sandbox and steal sensitive data including Keychain credentials, wallet private keys and Notes data.

    “exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials”
    SlowMist
  2. SlowMist's MistEye analysis identified more than 1,500 DarkSword-related phishing sites across the web.

    “1,500+ DarkSword-related phishing sites have been identified across the web”
    SlowMist
  3. The phishing sites target users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services and exchanges.

    “targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets”
    SlowMist
  4. SlowMist advises iPhone and iPad users to update iOS promptly and beware of apps potentially compromised by DarkSword.

    “iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword”
    SlowMist

Sources

More in Hacks & Security

All Hacks & Security stories →

Summary and claims extracted by AI with prompt analyze-story@5 on 2026-10-25 00:00 UTC. Labels are computed from the sources, not by the model.