SlowMist Warns of DarkSword iOS Safari Attack Targeting Crypto Wallets

SlowMist security team has identified a malicious campaign targeting iPhone users running iOS 18.4 through 18.6.2. The attack, dubbed DarkSword, utilizes a chain of six vulnerabilities—including WebKit remote code execution, sandbox escape, and kernel read/write—to compromise devices via Safari. This exploit allows attackers to access app container files, keychain data, and capture keystrokes from wallets like imToken, TokenPocket, and TronLink when they are active. While Apple has patched these vulnerabilities, the attack leverages n-day exploits. Users ar