BTC 
ETH 
BNB 
XRP 
SOL 
TRX SlowMist analyzes DarkSword iOS trojan backend and attack chain
SlowMist published a threat intelligence analysis of the DarkSword Trojan backend and iOS attack chain, stating that DarkSword-PROV2 appeared on GitHub in July 2026 after exploit code was publicly released in March 2026, with attack infrastructure observed online in late September. SlowMist says it traced the live infrastructure, linked admin panels to public GitHub repositories, and analyzed the exploit code, payload library, delivery chain and post-exploitation capabilities. It describes a pipeline covering exploit delivery, device and data collection, exfiltration and crypto wallet fund con
Why “Unverified”
- Reported by SlowMist alone, with no second source or primary confirmation yet
1 independent source group across 1 post · evidence score 72/100. How labels work
What the sources claim
-
SlowMist says DarkSword-PROV2 appeared on GitHub in July 2026 after DarkSword exploit code was publicly released in March 2026.
“DarkSword-PROV2 appeared on GitHub in July”
SlowMist -
SlowMist says the attack infrastructure was observed operating online in late September.
“attack infrastructure observed operating online in late September”
SlowMist -
SlowMist says it traced the live attack infrastructure and linked its admin panels to public GitHub repositories.
“linked its admin panels to public GitHub repositories”
SlowMist -
SlowMist describes the infrastructure as a complete attack pipeline integrating exploit delivery, device and data collection, exfiltration and crypto wallet fund consolidation.
“exploit delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation”
SlowMist -
SlowMist says the toolkit targets Keychain data, files, messages and crypto wallet data, with wallet decryption and fund consolidation capabilities.
“targets Keychain data, files, messages, and crypto wallet data”
SlowMist -
SlowMist says the toolkit claims iOS 13 and later support, but code analysis identifies narrower functional coverage.
“Although the toolkit claims support for iOS 13 and later, code analysis identifies”
SlowMist
Sources
- 🚨 Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain → slowmist.medium.com
More in Hacks & Security
Summary and claims extracted by AI with prompt analyze-story@5 on 2026-10-19 12:00 UTC. Labels are computed from the sources, not by the model.