More than 1,500 phishing sites are already live, targeting the private keys on your phone
🕐 最新解读群里更新
On the morning of October 24, SlowMist’s Cosine issued two alerts in a row. The first said that MistEye threat intelligence hunting had discovered more than 1,500 DarkSword phishing sites deployed across the internet. They target e-commerce, impersonate major trading platforms and wallets, and cover gaming and crypto-to-crypto exchanges. The second was more direct: DarkSword is carrying out targeted attacks on crypto users with iPhones and iPads. This is no longer just about tricking you into clicking a link—it exploits iOS vulnerabilities to break out of the sandbox.
⚠️ The words “break out of the sandbox” are the key point. Apple’s sandbox is meant to isolate each app, so one app can’t access another app’s data or read its Keychain. Once that wall is bypassed, the nature of what attackers can get changes: passwords stored in the Keychain, private key files for wallets stored locally, even seed phrases in your Notes app—all on the same device. Your phone hasn’t been lost, and you haven’t told anyone your password, yet your assets may already be gone.
What makes this even more concerning is the point of entry. SlowMist says this attack primarily infects apps that are already installed. You don’t need to click an unfamiliar link or scan a QR code. An app you installed long ago could become a conduit after an update. This is a whole different level of risk from the fake airdrop-site phishing of the past: the first relies on you making a mistake; the second only requires you to do nothing.
The timeline is worth a look, too. On October 19, SlowMist published a report saying that public code had been weaponized and that iOS crypto wallets were at risk. On September 25, their position was still that they couldn’t confirm whether iPhone Safari attacks had led to stolen assets. In less than a month, the situation went from unconfirmed to 1,500 sites across the internet and targeted attacks. That escalation is faster than most people imagine when it comes to phone security.
Now look at the market. Over the past 24 hours, $498 million in positions were liquidated across the crypto market 💥—$340 million in longs and $158 million in shorts. Bitcoin long liquidations totaled $81.33 million, and Ethereum long liquidations totaled $50.55 million. Bitcoin is around $80,800, down 1.23% over 24 hours. The market is falling and people are panicking. Phishing sites are at their most effective in moments like these: you’re rushing to add to your position or switch chains, and all it takes is one domain that looks right.
What this really changes isn’t just the risk of getting hacked once—it’s the assumption that your phone is a safe place for your wallet. People used to assume that not clicking links meant they were safe. That assumption no longer holds. Wallet providers will likely rethink how they store private keys locally. Hardware wallets, multisig, and keeping assets on separate devices will come back into focus. For everyday users, the steps are simple: update your operating system, avoid installing apps from untrusted sources, and don’t keep large amounts of assets in a hot wallet on an internet-connected phone for long 🦖
Those 1,500 sites weren’t set up in a day. The fact that they’re still active shows that this operation remains highly profitable.
How many wallet apps do you have on your phone? Have you ever wondered if one of them could be the entry point? Let’s talk in the comments.
Tap the profile picture to watch the livestream.
Every day, we bring you the latest in crypto security—not just what’s happening, but the logic and opportunities behind it 👀🚀
🕐 最新解读群里更新
On the morning of October 24, SlowMist’s Cosine issued two alerts in a row. The first said that MistEye threat intelligence hunting had discovered more than 1,500 DarkSword phishing sites deployed across the internet. They target e-commerce, impersonate major trading platforms and wallets, and cover gaming and crypto-to-crypto exchanges. The second was more direct: DarkSword is carrying out targeted attacks on crypto users with iPhones and iPads. This is no longer just about tricking you into clicking a link—it exploits iOS vulnerabilities to break out of the sandbox.
⚠️ The words “break out of the sandbox” are the key point. Apple’s sandbox is meant to isolate each app, so one app can’t access another app’s data or read its Keychain. Once that wall is bypassed, the nature of what attackers can get changes: passwords stored in the Keychain, private key files for wallets stored locally, even seed phrases in your Notes app—all on the same device. Your phone hasn’t been lost, and you haven’t told anyone your password, yet your assets may already be gone.
What makes this even more concerning is the point of entry. SlowMist says this attack primarily infects apps that are already installed. You don’t need to click an unfamiliar link or scan a QR code. An app you installed long ago could become a conduit after an update. This is a whole different level of risk from the fake airdrop-site phishing of the past: the first relies on you making a mistake; the second only requires you to do nothing.
The timeline is worth a look, too. On October 19, SlowMist published a report saying that public code had been weaponized and that iOS crypto wallets were at risk. On September 25, their position was still that they couldn’t confirm whether iPhone Safari attacks had led to stolen assets. In less than a month, the situation went from unconfirmed to 1,500 sites across the internet and targeted attacks. That escalation is faster than most people imagine when it comes to phone security.
Now look at the market. Over the past 24 hours, $498 million in positions were liquidated across the crypto market 💥—$340 million in longs and $158 million in shorts. Bitcoin long liquidations totaled $81.33 million, and Ethereum long liquidations totaled $50.55 million. Bitcoin is around $80,800, down 1.23% over 24 hours. The market is falling and people are panicking. Phishing sites are at their most effective in moments like these: you’re rushing to add to your position or switch chains, and all it takes is one domain that looks right.
What this really changes isn’t just the risk of getting hacked once—it’s the assumption that your phone is a safe place for your wallet. People used to assume that not clicking links meant they were safe. That assumption no longer holds. Wallet providers will likely rethink how they store private keys locally. Hardware wallets, multisig, and keeping assets on separate devices will come back into focus. For everyday users, the steps are simple: update your operating system, avoid installing apps from untrusted sources, and don’t keep large amounts of assets in a hot wallet on an internet-connected phone for long 🦖
Those 1,500 sites weren’t set up in a day. The fact that they’re still active shows that this operation remains highly profitable.
How many wallet apps do you have on your phone? Have you ever wondered if one of them could be the entry point? Let’s talk in the comments.
Tap the profile picture to watch the livestream.
Every day, we bring you the latest in crypto security—not just what’s happening, but the logic and opportunities behind it 👀🚀