From iOS 18.6 to 18.7.2, and from iOS 26.0 to 26.1, I’ll first mark out the versions that are actually vulnerable in this DarkSword report from SlowMist. The toolkit claims to support iOS 13 and later, but the code doesn’t match that claim. Exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, and the attack infrastructure was observed coming online in late September. SlowMist matched the admin panel to the public repository. The framework already bundles exploits, device and data collection, data theft, and cryptocurrency wallet fund consolidation. Keychains, files, messages, and wallet data are all within its reach; it can also decrypt wallet data and sweep out the funds. Public components have been assembled into a deployable attack framework. I’m looking at these specific point releases, not that claimed support range.
#安全事件 #木马