SlowMist Uncovers DarkSword Trojan Targeting iOS Crypto Wallets

Security firm SlowMist has released a comprehensive technical analysis regarding the DarkSword Trojan, a sophisticated malware family designed to compromise Apple’s mobile ecosystem. Initially appearing as public exploit code in March 2026, the threat evolved into the DarkSword-PROV2 iteration by July. Recent findings from late September 2026 indicate that the attack infrastructure is now fully operational, specifically targeting cryptocurrency wallet fund aggregation and sensitive user data exfiltration across various iOS versions.

Evolution and Infrastructure of DarkSword

The investigation by SlowMist tracked the development of the Trojan from its early stages on GitHub to its current state as a functional cyber-espionage and theft tool. The infrastructure is highly integrated, combining several malicious modules into a single delivery chain. These modules are responsible for exploit delivery, device fingerprinting, and the systematic collection of private data.

• Exploit Delivery: Automated mechanisms to deploy payloads via compromised web environments.
• Data Exfiltration: Unauthorized extraction of device logs, contacts, and encrypted messages.
• Fund Aggregation: Specialized scripts designed to scan for and drain cryptocurrency wallets on the infected device.

Technical Capabilities and Targeted Systems

Although the developers of the toolkit claim compatibility with iOS 13 and all subsequent versions, SlowMist’s code analysis suggests varying degrees of effectiveness depending on the specific patch level of the device. The DarkSword-PROV2 repository reveals a focus on the iOS attack chain, utilizing known vulnerabilities to escalate privileges and bypass the operating system's sandbox protections.

The infrastructure integrates functions such as exploit delivery, device and data collection, data exfiltration, and cryptocurrency wallet fund aggregation.

The backend management system, which researchers linked directly to the publicly available GitHub source code, allows attackers to monitor infected devices in real-time. This provides the threat actors with a centralized dashboard to manage private keys and seed phrases harvested from popular wallet applications.

By documenting the transition from public exploit code to active infrastructure, SlowMist highlights the rapid weaponization of security vulnerabilities within the blockchain ecosystem. Users are advised to keep their iOS devices updated to the latest firmware and exercise caution when interacting with unverified applications or links, as the DarkSword Trojan continues to refine its methods for bypassing mobile security protocols.