SlowMist's 23pds Reports Over 1500 DarkSword Phishing Sites Deployed Online
SlowMist's Chief Information Security Officer 23pds stated that their MistEye global threat intelligence hunting has currently discovered over 1500 DarkSword phishing sites deployed across the internet.
These sites cover various businesses including e-commerce, fake Binance, fake OKX, fake wallets, gaming, and cryptocurrency exchanges, luring users to click or visit through impersonation of well-known platforms.
DarkSword, as an iOS exploitation toolkit, can trigger an attack chain when users open malicious pages via Safari, stealing Keychain data, local files, communication records, and private keys and mnemonics of cryptocurrency wallets.
After the relevant exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, with the attack infrastructure going live at the end of September, integrating device data collection, data exfiltration, and cryptocurrency asset aggregation functions.
The effective exploitation window mainly focuses on iOS versions 18.6 to 18.7.2 and 26.0 to 26.1, although it claims to support earlier versions, most entries are incomplete.
Attackers deploy a large number of phishing sites to "sell" malicious entry points; once users visit, they may be "purchased" for device control, with funds flowing from victim wallets to attacker-controlled addresses, constituting event-driven targeted theft, putting pressure on exchanges and wallet impersonation channels.
Source: Public Information
ABAB AI Insight
SlowMist has previously released multiple analyses on DarkSword: After the Google Threat Intelligence Group disclosed this iOS exploit chain in March 2026, 23pds immediately warned of the tool's leak. On October 19, the team released a complete report on the backend and attack chain, showing that it took only a few months from the public code to weaponization to actual deployment.
The attack path goes from phishing landing pages (impersonating exchanges or e-commerce) → triggering Safari/WebKit vulnerabilities → collecting device data and wallet information → decrypting mnemonics and aggregating assets, motivated by the use of publicly available exploit code to lower the threshold and replicate sites in bulk to expand coverage of iPhone cryptocurrency users.
This is similar to previous iOS wallet theft tools like Coruna and malicious Firefox extensions impersonating Rabby/OKX, currently in a phase of rapid industrialization of publicly available exploit code by the black market, with intelligence hunting by security companies and monitoring of exchange impersonation becoming the main points of resistance.
Essentially, it is a technical substitution: publicly available exploit code lowers the threshold for professional attacks, allowing ordinary groups to deploy large-scale phishing infrastructure, forcing defenses to shift from patching single-point vulnerabilities to continuous hunting across all sites and isolating user devices.
ABAB News · Cognitive Laws
Publicly available exploit code equals a free arsenal for attackers
The number of phishing sites determines the coverage radius of attackable users
Impersonating exchanges is cheaper than directly hacking into exchanges