DarkSword exploit code turned into crypto-stealing trojan targeting iPhone Safari users, SlowMist warns

SlowMist threat intelligence reports that a publicly disclosed DarkSword exploit has been turned into a crypto-stealing trojan that can infect iPhone users who open a webpage in Safari. The exploit code was made public in March 2026, a DarkSword-PROV2 variant appeared on GitHub in July, and attack infrastructure was observed going live in late September.

Detected & updated continuously · Source: Nebula