Global Cybersecurity Alliance (GCSA) · Security Team

On October 22, GCSA Security Agent discovered during routine inspections that the search page of the crypto media outlet BlockBeats loaded a suspicious script from www.applonews.com. At the time, news search results were displayed normally, and the page did not request wallet connection or transaction confirmation.

1. No need to click on unfamiliar links: How does the BlockBeats search page load suspicious scripts?

[Figure 1] Screenshot of the pagesavedduring testing. Search results are displayed normally, and no wallet connection or transaction signature prompts appear.

We used Chrome to simulate an iPhone browser and visited the "Bitcoin" search results page of m.theblockbeats.info twice. In both visits, we recorded that the page first loaded `in-static.js`, then requested `start-view.html`. Network logs show that this script was initiated by the BlockBeats search page, and the server returned the complete code.

The `in-static.js` script inserts a hidden page into the webpage, loading `start-view.html`. The entire process requires no button clicks from the reader. Subsequently, the code reads the iOS version reported by the browser and loads the corresponding subsequent files.

Subsequent code retained the "DS" tag and indicated it would retry after the exploit stopped responding or crashed. The entry point configuration listed wallets such as imToken, MetaMask, and TronLink as targets. Based on this code and publicly available research, we identified it as the DarkSword deployment entry point. The final attack program has not yet been fully obtained, and the source of the script's introduction remains unknown. This loading occurred within the media's official domain, meaning readers may have accessed this code without clicking on unfamiliar links.

Attack script: www.applonews[.]com/in-static.js

[Figure 2] The request address is www.applonews[.]com/in-static.js, and the corresponding request is marked in red. HTTP 200 indicates that the server successfully returned the script; the Referer (source page) records the BlockBeats address.

[Figure 3] The initiator shows that in-static.js was loaded by BlockBeats' "Bitcoin" search page.

[Figure 4] The response code shows that in-static.js creates a hidden page in the webpage.

II. How does DarkSword threaten iPhone Wallet?

Google's Threat Intelligence team disclosed on March 18, 2026, that DarkSword consists of six vulnerabilities known to affect iOS 18.4 to 18.7. It starts with the browser and gradually gains higher system privileges, allowing malicious programs to read data that would otherwise be inaccessible via web pages. Even without connecting to a wallet or confirming a transaction, phones with these vulnerabilities can still be attacked while browsing the web.[1]This script selects subsequent files based on "iOS 18.4 and above," a wider range than publicly confirmed exploitable versions. Newer systems may have patched the vulnerability even if redirected to this file. Seeing the request log only confirms an attempt to load; it does not necessarily mean the phone has been compromised.

iVerify discovered in its public samples that compromised malware searches data files of wallets such as MetaMask, imToken, and Trust Wallet, and steals passwords stored on the phone.[2]If a usable private key or mnemonic phrase is obtained, the attacker can sign on their own device and transfer assets such as USDT from the wallet without the holder's confirmation.[3]Whether wallet files can be decrypted also depends on the wallet's protection method. Being listed as a target does not mean that every user of that wallet has been compromised.

It cannot be ruled out that related currency theft incidents have already occurred.

III. How iPhone users should respond: Update the system as soon as possible.

iPhone users who have visited this page should first go to "Settings—General—Software Update" to install the system update.[4]Users who are temporarily unable to update or need more stringent protection can enable "Lock Mode" in "Privacy & Security". This will disable some web technologies that may be used for attacks and will also affect the normal function of some websites.[5]These measures help reduce subsequent attacks, but if the data has already been stolen, updating the system cannot recover the copy in the hands of the attacker.

If you receive transfers you did not initiate, or if you confirm that your phone has been compromised, or that your private key or mnemonic phrase has been leaked, you should stop operating your wallet on that phone. Use another device with an updated system and no known signs of intrusion to check the transactions and create a wallet using a new mnemonic phrase before transferring your remaining assets.[6]Importing the old mnemonic phrase to another phone will restore the same wallet; if the mnemonic phrase has been leaked, simply changing the phone will not solve the problem. Changing the wallet unlock password will also not invalidate the leaked private key.

Users requiring further verification should retain the access time, the system version at the time, and any abnormal transaction records. When seeking assistance from the wallet's official support or security team, provide the necessary records for the investigation. Do not send mnemonic phrases or private keys to any "detection" webpages or private message contacts.

Source:

1. Google Threat Intelligence Group: DarkSword attack chain analysis, 2026-03-18.

2. iVerify: DarkSword and wallet data leakage analysis.

3. MetaMask: Mnemonic phrase and wallet control instructions.

4. Apple: Update your iPhone or iPad.

5. Apple: Regarding Lockout Mode.

6. Kraken: What to do after your wallet is compromised.

Evidence Collection Notes:The original pages, scripts, web logs (HAR), entry configurations, and SHA-256 checksums of files have been saved. Suspicious domains in the text are separated by [.], and the original URLs are preserved in the screenshots; red boxes indicate layout annotations, and the complete original images are saved separately. This article is based on a sample from October 22, 2026, and does not represent the current state of the site.

(On October 23, the GCSA security team contacted the BlockBeats website through official channels, informing them of the website vulnerabilities discovered by the GCSA security agent during routine inspections and expressing their willingness to provide assistance. Subsequently, they received a formal reply from BlockBeats via email: We have resolved the issue, thank you for your reminder.)

Copyright Notice:This report and related technical analysis are exclusively published by the GCSA Global Cybersecurity Alliance. For reprint permission, please retain the official GCSA source and original link in full, and do not maliciously alter the core viewpoints of the report.

Source:Global Cybersecurity Alliance (GCSA)
Website:www.gcsa.org