Slow Fog: iOS Safari DarkSword Attack Steals Wallet Inputs, Six Vulnerabilities Exploited

The Slow Fog security team has detected an attack targeting the iPhone Safari browser versions 18.4 to 18.6.2. Attackers have formed a complete attack chain using six vulnerabilities codenamed DarkSword, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write. This allows them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground. The Slow Fog team stated that these six vulnerabilities have been patched by Apple, and the current attack is a reuse of an n-day vulnerability chain. Merely visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.