SlowMist

🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users

⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.

DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.

🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.

🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.

📖 Related SlowMist analyses:

🔗 DarkSword Trojan Backend & iOS Attack Chain:
slowmist.medium.com/threat-intelli…

🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
slowmist.medium.com/threat-intelli…

🚨 SlowMist TI Alert 🚨

💸 @ankr Loss: ~$304.5k

🔍 Root Cause: The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and withdrawal amounts. All five receipts carried valid signatures from the bridge's trusted consensus signer, allowing withdraw() to release assets without independently verifying the receipts against the actual source-chain events.

⚠️ The origin of the unauthorized signatures remains under investigation. Signer compromise has not been confirmed.

📌 Attacker (Tx Sender): 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703
📌 Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6
📌 Vulnerable Contract: 0xc437DF90B37C1dB6657339E31BfE54627f0e7181

Powered by SlowMist.AI
Attack Tx:
etherscan.io/tx/0x7310af5d5…
etherscan.io/tx/0x90c563360…
etherscan.io/tx/0xde2d5b455…
etherscan.io/tx/0x91ba1a9c8…
etherscan.io/tx/0x46e20d4c8…

Reused Source Tx:
optimistic.etherscan.io/tx/0x02e805b51…

🚨 SlowMist TI Alert: Beware of the “Cracked TradingView Premium” Infostealer 🚨

Since mid-October, X account "cryptotrice" has repeatedly promoted a so-called “reverse-engineered cracked #TradingView Premium,” with some posts passing 300K views. The software requires downloading a password-protected archive and generating a license code via a KeyGen. 🔑

The author claims the project is open source on GitHub, but the download link in the article does not point to #GitHub. In some replies, the author also said the repo has been made private and that links are only available in-app and expire after a single use. Several users warned in the comments that it looks like malware stealing account info and crypto wallets, and one said their antivirus flagged and deleted it right after extraction. 🦠

We analyzed it and confirmed the Windows sample is an infostealer:
🔸 Collects browser credentials, crypto wallet data and Telegram data, and sends it to the C2 via WinINet
🔸 Uses Telegram and Steam to dynamically fetch and rotate C2 servers
🔸 The download site, arche-hypnose[.]com, appears to be a legitimate website compromised to distribute the malware
🔸 The macOS link currently returns 404, so no sample has been obtained

⚠️ If you have already run this software: disconnect from the network immediately, move your assets to a clean device with a new wallet and seed phrase, change passwords for your browsers, exchanges, email and Telegram, and terminate active Telegram sessions.

Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them. 🛡️

IOC
Sample source: teapawt[.]org/cryptotrice/article/2111472920241524897

Download links:
hxxps://www[.]arche-hypnose[.]com/get/ (Windows)
hxxps://www[.]arche-hypnose[.]com/mac/ (macOS, currently 404)

C2:
hxxps://xn[.]amanlay[.]org/rn/gate
hxxps://z[.]dak69[.]org/j/gate
hxxps://xn[.]amanlay[.]org/kw/gate

If you're experiencing disruptions to your KYT services, MistTrack is here to help.

Worth a read. A clear and detailed breakdown of a recruitment phishing attack that led to a malware infection simply by opening a project in Cursor.

Appreciate @brucexu_eth sharing this.