SlowMist: DarkSword iOS toolkit can steal wallet data from a malicious Safari page
Update
SlowMist: 1,500+ phishing sites
24 Oct: SlowMist says the DarkSword iOS trojan is being pushed through more than 1,500 phishing sites aimed at crypto users. No new dollar loss figure.
19 Oct 2026: SlowMist published analysis of a live iOS attack toolkit called DarkSword. It targets Keychain, messages, files, and crypto wallet data, then consolidates funds.
SlowMist says analysis shows working windows on recent iOS builds and that opening a malicious page in Safari may be enough. No new dollar loss figure. Research snapshot from SlowMist.
369 take
Update iOS. SlowMist now counts the toolkit behind 1,500+ phishing sites. If the phone opened a suspicious page, treat seeds on that device as burned and move funds from a clean device.
Do not type a seed into any checker.
Sources