Welcome to @crypt_byte!
Whether youโre new to Web3 or a seasoned pro, we're here to keep you safe in the crypto wild. Letโs start with 4 newbie-friendly safety tips to protect yourself. #Web3Safety
Older iOS flaws are being exploited to steal Web3 keys and crypto. #Coruna and #DarkSword fuel exploit trading, malware sales, phishing and trojanized apps. Our report breaks down the attacks, operators, money trails and how to stay safe ๐ https://t.co/SkjoRyvBY2
๐จ SlowMist TI Alert: DarkSword Targets iPhone Crypto Users
โ ๏ธ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.
DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.
๐ According to SlowMistโs MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.
๐ก๏ธ Stay safe:
โข Keep your iOS devices updated.
โข Be cautious of suspicious or compromised apps.
โข Never store sensitive wallet credentials or seed phrases in Notes.
๐ Related SlowMist analyses:
๐ DarkSword Trojan Backend & iOS Attack Chain:
https://t.co/B1hYr9mGl5
๐ FomoPeek App Store Poisoning & iOS Kernel Exploitation:
https://t.co/IcHU32boZb
Attackers trick users with fake emails, cloned MetaMask pages, and urgent deadlines.
MetaMask will never ask for your seed phrase, any site or email that does is a scam.
New phishing wave targeting @MetaMask users.
Scammers are pushing fake security updates that impersonate MetaMask.
The flow is simple:
- users are sent to a fake security page
- told that 2FA is now required
- asked to enter their seed phrase during the verification
Once the phrase is submitted, the wallet is fully compromised.
A user lost $50M in USDT in an address poisoning incident, according to @web3_antivirus.
The victim sent a small test transfer to the correct address, then sent the main transfer to a lookalike address copied from transaction history.
[Brought to you by @web3_antivirus]
Scammers are still pushing fake MEV bot 'tutorials' that look trustworthy, complete with presenters, high production quality and comment sections filled with social proof.
Behind the scenes, the contracts linked in these videos hide the attackerโs wallet inside obfuscated code. Victims follow the steps, fund the bot and unknowingly trigger the function that drains their acc.