Slow Fog: iOS Safari DarkSword Attack Steals Wallet Inputs, Six Vulnerabilities Exploited

The Slow Fog security team has detected an attack targeting the iPhone Safari browser versions 18.4 to 18.6.2. Attackers have formed a complete attack chain using six vulnerabilities codenamed DarkSword, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write. This allows them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground. The Slow Fog team stated that these six vulnerabilities have been patched by Apple, and the current attack is a reuse of an n-day vulnerability chain. Merely visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.