# SlowMist Finds Public DarkSword Code in Deployable iOS Attack Kit

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/34802
Published: 2026-10-19T13:25:52.000Z
Updated: 2026-10-19T13:25:52.000Z
Section: Technology

> The toolkit targets crypto wallet data, with effective exploit windows on iOS 18.6–18.7.2 and 26.0–26.1.

A deployable iOS attack framework built from public DarkSword exploit code can steal crypto wallet data, creating an immediate risk for users on a narrow range of software versions.

Its effective exploit coverage is concentrated on iOS 18.6 through 18.7.2 and iOS 26.0 through 26.1. The toolkit claims support for iOS 13 and later, but the working exploit range is narrower.

The attack chain automates exploit delivery, device and data collection, theft and cryptocurrency fund consolidation. It targets the iPhone Keychain, files, messages and wallet data, and includes functions to decrypt wallet information and consolidate funds.

Public exploit components became available in March 2026. DarkSword-PROV2 appeared on GitHub in July, and the associated infrastructure was observed running in late September.

A malicious page opened in Safari may trigger an exploit. Anyone who visited a suspicious landing page should treat recovery phrases and private keys as exposed, create a new wallet on a clean device, check for unauthorized transactions and revoke unnecessary token approvals.