iPhone Attacks Targeting Cryptocurrency Exceed 1,500 Related Fake Sites, Says SlowMist

Key Points of This Article

• Over 1,500 related phishing sites confirmed
• Fixed in iOS 26.3 and updated to 18.7.7 for iOS 18

Over 1,500 Fake Sites Related to DarkSword

Blockchain security company SlowMist revealed on the 24th that it has confirmed over 1,500 phishing sites related to the attack tool "DarkSword," which exploits vulnerabilities in iOS. According to the company's threat monitoring system "MistEye," these sites disguise themselves as e-commerce sites, major exchanges, cryptocurrency wallets, and gaming services to lure users. The company urged iPhone and iPad users to promptly update their iOS.

DarkSword combines six vulnerabilities (software flaws) present in iOS to bypass the app isolation mechanism (sandbox) and steal information from the device. The targets include authentication information from the keychain (password storage feature), secret keys of wallets saved on the device, and data from notes. The attack begins simply by opening a manipulated page in Safari. The threat intelligence group from Google (GTIG) and security firms iVerify and Lookout announced this in March, after which the code leaked online.

10 Successful Intrusions on Attack Servers

On October 19, SlowMist also published a report analyzing active attack servers. The management screen recorded 20,187 page views and 1,187 intrusion attempts over 30 days, with 9 out of 10 successful attempts progressing to data exfiltration. The attacks are successful on iOS versions 18.6 to 18.7.2 and 26.0 to 26.1.

Other security firms have also reported new tactics. On October 8, iVerify announced a variant called "P7 DarkSword" found on the iPhone of a financial institution employee. U.S. Censys investigated the attack servers and confirmed the capability to locate seed phrases (word sequences for wallet recovery) saved in photos and notes. According to Malwarebytes, fake sites disguised as pre-orders for the new iPhone were also discovered in September.

Caution on iOS Updates and Saving in Notes

Apple has fixed all vulnerabilities exploited by DarkSword by iOS 26.3. For devices continuing to use iOS 18, the distribution of iOS 18.7.7 was expanded on April 1. Updates can be performed from the "General" section in the settings app under "Software Update." SlowMist has requested users not to save wallet authentication information or seed phrases in notes and to be cautious of suspicious apps. If users remember opening suspicious pages on devices before the update, they are advised to create a new wallet on a different device that has not opened that page and transfer their assets.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.