Cos(余弦)😶‍🌫️

Founder of @SlowMist_Team // 分身一号/捉虫大师/救火运动员 // 🕖灾备频道

[Cos(余弦)😶‍🌫️ @evilcos]

这行业割韭菜的行为越多，诈骗越多，跑路越多，黑客事件只会越多，一些有能力的黑客决不允许在“聪明”赚钱这块输过这般人。

[Cos(余弦)😶‍🌫️ @evilcos]

@ElectrumWallet 👀

[Yishi @ohyishi]

If your iPhone or another iOS device is still running iOS 26.2 or an earlier iOS 26 release, pay attention.

DarkSword is a powerful iOS exploit chain. Researchers have confirmed attacks targeting iOS 18.4 through 18.7.2, and some of the underlying vulnerabilities remained unpatched in iOS 26.2. The final fix only arrived with iOS 26.3.

If your device is vulnerable and you happen to visit a malicious website exploiting DarkSword, this is pretty much what your iPhone could look like to an attacker.

We’re talking about system level exploitation. Once an attacker gains sufficient privileges, the impact can extend far beyond the app where the attack started.

Even if App A is the initial entry point, sensitive data in App B could also be exposed, including your crypto wallets.

Be careful which apps you install and which links you open.

Always update to the latest iOS version available for your device.

If you’re staying on iOS 26, make sure you’re on at least 26.3. If you’re still on iOS 18, update to 18.7.7 or later.

If you can’t update immediately, especially if you’re using an iPhone as a cold wallet or have multiple software wallets installed, such as MetaMask, Phantom, or others, I strongly recommend enabling Lockdown Mode.

Here’s how:

- Open Settings.
- Go to Privacy & Security.
- Scroll down and tap Lockdown Mode.
- Tap Turn On Lockdown Mode, then Turn On & Restart.
- Enter your passcode to confirm.

Lockdown Mode will restrict certain features, but that’s a reasonable tradeoff when you’re storing significant crypto assets on your phone.

And please remember, Lockdown Mode is no substitute for security updates. Keep your devices patched.

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users

⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.

DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.

🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.

🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.

📖 Related SlowMist analyses:

🔗 DarkSword Trojan Backend & iOS Attack Chain:
https://t.co/B1hYr9mGl5

🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
https://t.co/IcHU32boZb

[Cos(余弦)😶‍🌫️ @evilcos]

珍惜 AI 小子的时代吧🤣后面的 AI 可能很快限制更多了…

[Cos(余弦)😶‍🌫️ @evilcos]

上一代的漏洞是真刺激，即使没有 AI，全网脚本小子人手一套成熟且通杀的漏洞利用：

心脏出血、破壳、永恒之蓝等…

这一代的，刚冒头，普遍 AI 味浓了些，那叫什么？鸡肋？食之无味弃之可惜…PHP2Shell 这个没有稳定通杀利用出现前，只能是另一个鸡肋：巨型鸡肋。

以前脚本小子，现在全民 AI 小子。

[Cos(余弦)😶‍🌫️ @evilcos]

@landiantech 黑阔们在急中生智中😁

[Cos(余弦)😶‍🌫️ @evilcos]

随机提醒下，及时更新你的 iPhone/iPad 系统，小心你已安装的某些 App 被投毒了 DarkSword…

这玩意主要目标是针对 iPhone 币圈用户的钱包…定点攻击，定点盗币。利用 iOS 相关漏洞突破沙盒，窃取 Keychain 里的各类密码等隐私数据，窃取钱包本地私钥文件、备忘录等隐私数据。

我们此前相关解析：

威胁情报｜DarkSword 木马后台及 iOS 攻击链分析 https://t.co/1pzYSDz5nb

威胁情报｜FomoPeek App Store 投毒与 iOS 内核利用分析 https://t.co/8f7KnKL0DR

[Cos(余弦)😶‍🌫️ @evilcos]

@brucexu_eth AI - 新时代巨型后门🤣

[Foresight News丨APP 重磅更新 @Foresight_News]

🛡慢雾：iOS 用户需及时更新系统以防 DarkSword 病毒攻击

慢雾余弦 @evilcos 发文称，用户应及时更新 iPhone 和 iPad 系统，并警惕已安装的部分 App 遭 DarkSword 投毒。

DarkSword 主要针对 iPhone 币圈用户进行定点攻击和盗币，利用 iOS 相关漏洞突破沙盒，窃取 Keychain 中的各类密码等隐私数据，以及钱包本地私钥文件、备忘录等隐私数据。

[Cos(余弦)😶‍🌫️ @evilcos]

给 @BlockBeatsAsia 点赞👍

[BlockBeats｜We're hiring! @BlockBeatsAsia]

关于律动 BlockBeats 网页端异常脚本事件，我们已完成相关页面的排查、复现与修复，并将继续排查潜在安全风险。

安全没有终点。感谢慢雾 SlowMist、GCSA 等安全团队第一时间提供协助，也感谢所有持续维护行业安全的从业者。

再次提醒：律动 BlockBeats 从未支持「钱包登录」或「连接钱包」功能，请用户提高警惕，谨防第三方虚假 App。iOS 用户也请及时更新系统，做好安全防护。

我们将持续加强外部脚本审核、页面资源监测与异常告警机制，尽最大努力保障用户的访问安全。

[Cos(余弦)😶‍🌫️ @evilcos]

1500+ DarkSword 钓鱼站点…

[23pds (山哥) @im23pds]

同时，根据慢雾 @SlowMist_Team MistEye 全网威胁情报狩猎发现，目前全网部署有 1500+ DarkSword钓鱼站点，涉及 电商、虚假Binance、虚假okx、虚假钱包、游戏、加密货币兑换等等业务。

[BlockBeats｜We're hiring! @BlockBeatsAsia]

‼️ 关于律动 BlockBeats 网页端异常脚本事件，我们已完成相关页面的排查、复现与修复，并将继续排查潜在安全风险。

安全没有终点。感谢慢雾 @SlowMist_Team @evilcos 、@GCSAHK 等安全团队第一时间提供协助，也感谢所有持续维护行业安全的从业者。

再次提醒：律动 BlockBeats 从未支持「钱包登录」或「连接钱包」功能，请用户提高警惕，谨防第三方虚假 App。iOS 用户也请及时更新系统，做好安全防护。

我们将持续加强外部脚本审核、页面资源监测与异常告警机制，尽最大努力保障用户的访问安全。

[Cos(余弦)😶‍🌫️ @evilcos]

@drjingle + Google 等也是如此…广告行业黑灰链条过于庞大。

[Cos(余弦)😶‍🌫️ @evilcos]

@brucexu_eth @xsser_w @0xrootRE 👀

[Cos(余弦)😶‍🌫️ @evilcos]

@0xLoki_Zeng 端掉黄牛

[SlowMist @SlowMist_Team]

🚨 Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor

@SlowMist_Team recently received user reports about a GitHub repository named sol-live, presented as a #Solidity interview practice project. Analysis revealed a hidden download-and-execute command in .vscode/settings.json that can run a remote script when the project's custom terminal configuration is launched.

🔍 The retrieved payload contains three main modules capable of:

🔹 Collecting browser login databases and wallet extension storage, and copying #macOS Keychain files
🔹 Scanning and uploading local files
🔹 Executing remote commands, providing interactive shell access, and monitoring clipboard contents

⚠️ On macOS/Linux, execution requires users to actively launch the malicious terminal configuration. The #Windows execution chain remains unconfirmed due to potential quoting issues.

We also identified 8 other #GitHub projects with similar terminal-based download-and-execute techniques. The analysis does not confirm the actual scope of infection or whether data was exfiltrated.

🛡️ Recommendations:
Review .vscode/settings.json and terminal launch arguments before using untrusted projects. If execution is confirmed or cannot be ruled out, isolate and investigate the affected host, then migrate wallet assets and rotate relevant credentials from a trusted device.

Read the full analysis 👇
https://t.co/lH4J1umLxl

[Cos(余弦)😶‍🌫️ @evilcos]

假装 PHP2Shell 稳定利用代码仓库，加上这个技巧，啪，上钩一堆机器…🫣

[Cos(余弦)😶‍🌫️ @evilcos]

针对 VS Code 类编辑器（包括 Cursor、Trae 等）的恶意命令执行技巧，和之前披露的不一样了👀

详情：Web3 面试题暗藏盗窃后门 https://t.co/Tneb66s0Ok

[Cos(余弦)😶‍🌫️ @evilcos]

@ProbiusOfficial 学会了

[Cos(余弦)😶‍🌫️ @evilcos]

@ynpnpn296167 @KeystoneCN @KeystoneWallet 👍 去宠物医院给硬件钱包拍X光片