iVerify disclosed P7 DarkSword, a reworked variant of a leaked iOS exploit kit for iPhones on iOS 18.4 to 18.7 that steals keychain and crypto-wallet data. The commercial chain leaked onto a second-hand market, where financially motivated operators have been buying it since late 2025.
Reality
- Evidence55
- Adoption40
- Hype gap+5
- Incentives30
- Confidence50
buildConfirmed2 publishers Socket found 16 Firefox extensions posing as Rabby and OKX wallets that intercept recovery phrases and private keys during wallet import. Names and IDs rotated behind a screen that still read Rabby Wallet, so only an allowlist of exact extension IDs holds up.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+5
- Incentives40
- Confidence65
Socket says trojanized OphimCMS and KKPhim themes chain two WebKit bugs to an IOKit kernel escape on visitors' iPhones, turning a Composer dependency problem into wallet seed theft from people who only loaded a page.
Reality
- Evidence54
- Adoption32
- Hype gap+12
- Incentives68
- Confidence52
Microsoft says the campaign now delivers its payload through a command pasted into Terminal rather than a .dmg installer. The review step that mattered was tied to that older delivery method, and the attackers no longer need it.
Reality
- Evidence64
- Adoption52
- Hype gap+8
- Incentives68
- Confidence60
Huntress says a researcher targeted after Black Hat and Def Con was sent a Google Doc that rendered an Apps Script sidebar with ClickFix instructions. The lure arrived by DM, not email.
Reality
- Evidence68
- Adoption34
- Hype gap+14
- Incentives62
- Confidence66
buildOne report1 publisher Socket says 40 of the 77 extensions it tracked are confirmed credential and wallet stealers, and nine of them were repurposed from sports-score shells under the same add-on IDs.
Reality
- Evidence70
- Adoption24
- Hype gap+14
- Incentives72
- Confidence58