SlowMist CISO Flags iOS Tool Claiming Crypto Wallet Data Theft

SlowMist CISO 23pds wrote Sunday that an underground seller advertises an iOS tool claimed to help attackers seek device access after a user clicks a phishing link, then steal cryptocurrency wallet data.

The claimed method uses links sent by text, email or chat. After a click, attackers may try to access the device and collect Keychain data, chat records, file credentials and information related to crypto wallets.

The seller also advertises a centralized control panel, remote shell access and management for multiple devices, along with monitoring of a device’s camera, microphone, location and screen. Other advertised functions include initial access, privilege escalation, data export and persistence after a reboot. The listing claims techniques for bypassing pointer authentication (PAC), escaping the sandbox and gaining kernel read/write access.

23pds questioned whether the package works with iOS 27.2, saying its compatibility claim may be exaggerated or unreliable. He speculated that the tool may be an upgraded version of Darksword and urged users to install system updates and avoid unfamiliar links.