Slow Mist CISO: Underground forums are selling remote control tools claimed to support iOS 13 to 27.2, which can steal keychain and encrypted wallet data

According to a post by Slow Mist CISO 23pds, there are reports on underground forums of a remote control tool claimed to support iOS versions 13 to 27.2, equipped with a centralized control panel. Attackers are said to be able to deliver phishing links via SMS, chat applications, or email, attempting to gain device access after the user clicks on them, thereby stealing Keychain data, chat logs, file credentials, and cryptocurrency wallet-related data. They can also monitor the camera, microphone, location, and screen, and support remote Shell and multi-device management.

The tool claims to have six capabilities: initial access, privilege escalation, persistence after reboot, data export, real-time monitoring, and remote control, involving techniques such as bypassing pointer authentication (PAC), escaping sandboxes, and obtaining kernel read/write permissions. However, Slow Mist CISO expressed doubts about its compatibility, believing that its claim to support iOS 27.2 may be exaggerated or have stability issues, and speculated that the tool might be an upgraded version of Darksword. They also remind users to update their systems promptly, exercise caution when clicking on unknown links in SMS, emails, and chat applications, and pay attention to the security of their devices and cryptocurrency assets.