Public exploit code weaponized as SlowMist releases DarkSword trojan analysis report

Odaily reports that SlowMist has released an analysis report on the DarkSword trojan's backend and iOS attack chain. According to the report, after the relevant exploit code was publicly disclosed in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed coming online in late September. SlowMist traced the related online infrastructure, linked its management panel to a public GitHub repository, and analyzed the exploit code, delivery chain, and post-compromise exploitation capabilities. The report shows that the attack framework integrates exploit, device and data collection, data exfiltration, and crypto wallet fund consolidation functions. It can target keychains, files, messages, and crypto wallet data, and has the ability to decrypt wallet data and consolidate funds. Although the toolkit claims support for iOS 13 and later, code analysis shows that its actually effective exploitation window is concentrated in iOS 18.6 to 18.7.2 and iOS 26.0 to 26.1. The public exploit components have been integrated into a deployable attack framework. SlowMist advises users to update their iOS systems promptly and avoid clicking untrusted links; opening malicious pages in the Safari browser may also trigger the exploit. If a device has visited a suspicious landing page, users should treat their mnemonic phrase and private key as compromised, use a clean device that has never visited the page to create a new wallet and transfer assets, and check for abnormal transactions and token approvals across chains, revoking unnecessary approvals.