
Founder of @SlowMist_Team // 分身一号/捉虫大师/救火运动员 // 🕖灾备频道 https://xitter.cf/t.co/bMGdsBkYwM
HACKING
Joined November 2008
- Tweets9.9K
- Following1.6K
- Followers126K
- Likes28.6K
If your iPhone or another iOS device is still running iOS 26.2 or an earlier iOS 26 release, pay attention.
DarkSword is a powerful iOS exploit chain. Researchers have confirmed attacks targeting iOS 18.4 through 18.7.2, and some of the underlying vulnerabilities remained unpatched in iOS 26.2. The final fix only arrived with iOS 26.3.
If your device is vulnerable and you happen to visit a malicious website exploiting DarkSword, this is pretty much what your iPhone could look like to an attacker.
We’re talking about system level exploitation. Once an attacker gains sufficient privileges, the impact can extend far beyond the app where the attack started.
Even if App A is the initial entry point, sensitive data in App B could also be exposed, including your crypto wallets.
Be careful which apps you install and which links you open.
Always update to the latest iOS version available for your device.
If you’re staying on iOS 26, make sure you’re on at least 26.3. If you’re still on iOS 18, update to 18.7.7 or later.
If you can’t update immediately, especially if you’re using an iPhone as a cold wallet or have multiple software wallets installed, such as MetaMask, Phantom, or others, I strongly recommend enabling Lockdown Mode.
Here’s how:
- Open Settings.
- Go to Privacy & Security.
- Scroll down and tap Lockdown Mode.
- Tap Turn On Lockdown Mode, then Turn On & Restart.
- Enter your passcode to confirm.
Lockdown Mode will restrict certain features, but that’s a reasonable tradeoff when you’re storing significant crypto assets on your phone.
And please remember, Lockdown Mode is no substitute for security updates. Keep your devices patched.
Cos(余弦)😶🌫️ retweeted
🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users
⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.
DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.
🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.
🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.
📖 Related SlowMist analyses:
🔗 DarkSword Trojan Backend & iOS Attack Chain:
slowmist.medium.com/threat-i…
🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
slowmist.medium.com/threat-i…
上一代的漏洞是真刺激,即使没有 AI,全网脚本小子人手一套成熟且通杀的漏洞利用:
心脏出血、破壳、永恒之蓝等…
这一代的,刚冒头,普遍 AI 味浓了些,那叫什么?鸡肋?食之无味弃之可惜…PHP2Shell 这个没有稳定通杀利用出现前,只能是另一个鸡肋:巨型鸡肋。
以前脚本小子,现在全民 AI 小子。
Cos(余弦)😶🌫️ retweeted
🛡慢雾:iOS 用户需及时更新系统以防 DarkSword 病毒攻击
慢雾余弦 @evilcos 发文称,用户应及时更新 iPhone 和 iPad 系统,并警惕已安装的部分 App 遭 DarkSword 投毒。
DarkSword 主要针对 iPhone 币圈用户进行定点攻击和盗币,利用 iOS 相关漏洞突破沙盒,窃取 Keychain 中的各类密码等隐私数据,以及钱包本地私钥文件、备忘录等隐私数据。
随机提醒下,及时更新你的 iPhone/iPad 系统,小心你已安装的某些 App 被投毒了 DarkSword…
这玩意主要目标是针对 iPhone 币圈用户的钱包…定点攻击,定点盗币。利用 iOS 相关漏洞突破沙盒,窃取 Keychain 里的各类密码等隐私数据,窃取钱包本地私钥文件、备忘录等隐私数据。
我们此前相关解析:
威胁情报|DarkSword 木马后台及 iOS 攻击链分析 mp.weixin.qq.com/s/2RnkSMKrz…
威胁情报|FomoPeek App Store 投毒与 iOS 内核利用分析 mp.weixin.qq.com/s/LjhN6oejb…
1500+ DarkSword 钓鱼站点…
Replying to @im23pds
同时,根据慢雾 @SlowMist_Team MistEye 全网威胁情报狩猎发现,目前全网部署有 1500+ DarkSword钓鱼站点,涉及 电商、虚假Binance、虚假okx、虚假钱包、游戏、加密货币兑换等等业务。
给 @BlockBeatsAsia 点赞👍
Cos(余弦)😶🌫️ retweeted
‼️ 关于律动 BlockBeats 网页端异常脚本事件,我们已完成相关页面的排查、复现与修复,并将继续排查潜在安全风险。
安全没有终点。感谢慢雾 @SlowMist_Team @evilcos 、@GCSAHK 等安全团队第一时间提供协助,也感谢所有持续维护行业安全的从业者。
再次提醒:律动 BlockBeats 从未支持「钱包登录」或「连接钱包」功能,请用户提高警惕,谨防第三方虚假 App。iOS 用户也请及时更新系统,做好安全防护。
我们将持续加强外部脚本审核、页面资源监测与异常告警机制,尽最大努力保障用户的访问安全。
Cos(余弦)😶🌫️ retweeted
🚨 Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor
@SlowMist_Team recently received user reports about a GitHub repository named sol-live, presented as a #Solidity interview practice project. Analysis revealed a hidden download-and-execute command in .vscode/settings.json that can run a remote script when the project's custom terminal configuration is launched.
🔍 The retrieved payload contains three main modules capable of:
🔹 Collecting browser login databases and wallet extension storage, and copying #macOS Keychain files
🔹 Scanning and uploading local files
🔹 Executing remote commands, providing interactive shell access, and monitoring clipboard contents
⚠️ On macOS/Linux, execution requires users to actively launch the malicious terminal configuration. The #Windows execution chain remains unconfirmed due to potential quoting issues.
We also identified 8 other #GitHub projects with similar terminal-based download-and-execute techniques. The analysis does not confirm the actual scope of infection or whether data was exfiltrated.
🛡️ Recommendations:
Review .vscode/settings.json and terminal launch arguments before using untrusted projects. If execution is confirmed or cannot be ruled out, isolate and investigate the affected host, then migrate wallet assets and rotate relevant credentials from a trusted device.
Read the full analysis 👇
slowmist.medium.com/threat-i…
针对 VS Code 类编辑器(包括 Cursor、Trae 等)的恶意命令执行技巧,和之前披露的不一样了👀
详情:Web3 面试题暗藏盗窃后门 mp.weixin.qq.com/s/LdgE0MHKg…
I've been blown away by the energy, optimism, and hard work that has created the China I've seen on this trip. It had been seven years since I was last here, and it might as well have been forty. Invigorating to see what's possible. The West has no excuse for its managed decline.
😁我都用,尤其 Hermes Agent + DeepSeek 自由度高,安全分析工作更加游刃有余。
Grok Bot/Cursor/Muse 的云主机对我来说也有不错的使用场景,基本每天都会打开使用。
这是我手机上的。电脑里的 ChatGPT/Cursor/DeepSeek Harness 为主。
至于其它的…会用,选择多,不至于被一家绑架。
已经把我的 龙虾/爱马仕 彻底删库了😆
纯手敲《Grokbot vs 龙虾/爱马仕 十胜十负!》
Grokbot 可以包月,不用按 Token 计费,此乃一胜;
Grokbot 与推特共享会员,此乃二胜;
Grokbot 自带云电脑,不用配 Mac Mini,此乃三胜;
Grokbot 下载直接就用,此乃四胜;
Grokbot 无需折腾 Skill 等奇技淫巧,此乃五胜;
Grokbot 无需研究 MCP 等奇技淫巧,此乃六胜;
Grokbot 不用浪费太多时间在安全上,此乃七胜;
Grokbot 会主动说话、办事,此乃八胜;
Grokbot 不设模型切换,避免选择困难,此乃九胜;
Grokbot 创始人格局远胜 Peter(爱拉黑),合计十胜!
Cos(余弦)😶🌫️ retweeted
🚨SlowMist TI Alert🚨
💸 @WAX_io Loss: ~$90.5K
🔍 Root Cause: WAX’s eth.token::withdraw failed to enforce max_fee ≥ 0 before debiting quantity + max_fee. Setting max_fee = -quantity reduced the debit to zero while preserving the full withdrawal amount. With the configured fee at zero, the fee check was skipped. On-chain records confirm that these requests generated bridge withdrawal logs and corresponding payouts on Solana and Ethereum.
📌 Attacker: WAX: fasdfas.al; Solana: 4H1piNZ8LsYhZGYhkbJDbPDSghxRj3HWxJqVz5dve8Q7; Ethereum: 0x01664E199991b2F3fe412c2DE5B9b7A0dcDc5070
📌 Victim: WAX Multi-Chain Bridge — Solana: 8cqv3kRg1ivwPNrGGrvJANXb6RPik6XEhnBzs18tPcKC; Ethereum: 0x24b22B031Ae1B5a6b09F9a0FD33613a40e0d70e6
📌 Vulnerable Contract: eth.token on WAX
Powered by SlowMist.AI
Cos(余弦)😶🌫️ retweeted
🚨 SlowMist TI Alert 🚨
The Fearless Wallet browser extension is malicious, with a threat exposure period spanning nearly 20 months, from February 2025 to October 2026. Affected versions include 3.0.1 and 3.0.3–3.0.5, containing malicious code designed to steal wallet recovery phrases, private keys, and keystore files when users unlock their wallets.
The stolen data is encrypted using an empty password and exfiltrated through HTTP GET requests to tonscanner.org. A remote configuration file allows attackers to enable or disable the malicious behavior.
Users who have used the affected extension since February 2025 should consider their wallets compromised. Immediately create new wallets with fresh private keys, transfer remaining assets, review suspicious transactions, and remove the affected extension. Changing passwords or reinstalling the extension is insufficient.
Malicious Chrome Extension ID: nhlnehondigmgckngjomcpcefcdplmgc
You can also visit misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe.
As always, stay vigilant!
hackmd.io/@gWEUMERvQZyR5MSts…
enterprise.misteye.io/threat…
Security Alert for Fearless Wallet
Fearless Wallet is a third-party application, built and maintained by an independent team.
Following an investigation by the Polkadot Technical Fellowship on behalf of the @PCF_org, it was found that the Fearless Wallet browser extension had been compromised and had been leaking users’ private keys since February 2025.
If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible.
Remember to never share your private keys.
Fearless Wallet 浏览器扩展在 2025 年 2 月起就被植入恶意代码,会在用户解锁钱包时泄露私钥,跨度近 20 个月才被发现…👀
Security Alert for Fearless Wallet
Fearless Wallet is a third-party application, built and maintained by an independent team.
Following an investigation by the Polkadot Technical Fellowship on behalf of the @PCF_org, it was found that the Fearless Wallet browser extension had been compromised and had been leaking users’ private keys since February 2025.
If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible.
Remember to never share your private keys.
昨晚有点群魔乱舞,应急除了 PHP2Shell、eMudhra CA Keys 泄露事件,还有 GitLab 的又一个满分漏洞、LiteLLM 再此被供应链投毒、Node.js 几个高危漏洞,几起不大相关的加密被盗事件…
天亮了,日出东方,人间忙碌,井然有序,互联网上除了八卦多了些外,波澜不惊的样子和以往没什么区别…
























