🚨 Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft SlowMist Security Team identified a campaign masquerading as a free VPS service. The landing page at event[.]polarnode[.]vip is a decoy that silently loads lk[.]js and screens for iPhone Safari on iOS 18.4–18.6.2. https://t.co/1j7mPDr0vI
SlowMist Security Team identified a campaign targeting iOS Safari users on specific versions (18.4–18.6.2) via a fake VPS service landing page. The decoy page loads JavaScript that screens for iPhones, potentially leading to asset theft from the DarkSword wallet.