iossecurity

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.