Heh

[Heh @Heh12495]

@HotsexTVS Check messages

[Money Talks @MoneyTalksTwt]

If you want big money, you better have some big fcking balls

[CyberSatoshi 𓆙 @XBToshi]

CT is currently treating DarkSword, FomoPeek, and worse_query as interchangeable names for the same bug.

They represent three entirely different attack surfaces with distinct mechanics:

1. DarkSword (The Browser Exploit Kit):
- Vector: WebKit / Safari zero-click memory corruption.
- Delivery: Malvertising ad networks. You don't install an app; loading a compromised page with a malicious iframe runs the exploit in the background.
- Target: iOS devices (18.x and 26.1 26.2).

2. FomoPeek (The App Store Supply-Chain Trojan):
- Vector: App Store review bypass (September 2026).
- Delivery: Shipped through official App Store updates (v1.1/1.2).
- Mechanics: Embedded a kernel exploit toolkit that escaped the sandbox and dumped secrets directly from the iOS Keychain, draining ~$580K before SlowMist and OKX intervened.

3. worse_query (The Sideload Container Escape):
- Vector: App Group container sandbox bypass (Disclosed Nov 8, 2026).
- Delivery: Requires a sideloaded or enterprise-signed IPA on the device.
- Mechanics: Reads unencrypted local files of other apps (e.g. plaintext seed backups or cached configs). It does NOT dump the Keychain.
Confirmed STILL UNPATCHED in iOS 27.2.1.

The Bottom Line:

Whether the attack vector is a browser banner, a poisoned App Store app, or a third-party sideload — the conclusion never changes:
Never store material wealth on a connected device that renders untrusted code.