P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

2026-10-11T07:23:59Z•2f4ea049d6dd329aff359de60f6a9f0a9d599c2ed3f7f077c6f3848b48a1cc17
CVE-2015-3306CVE-2026-105133CVE-2026-107406AI securityAPTCISA KEVFlax TyphoonGitHub Actionsactive exploitationcredential theftcryptocurrency theftcryptominingphishingpre-authenticationremote code executionroot accesssupply chain compromiseweb shells

What happened

The feed reports active exploitation and disclosure of multiple high-impact vulnerabilities and campaigns, including a pre-authenticated AnyDesk Linux exploit enabling root access, AhsayCBS flaws exploited to deploy web shells and XMRig miners, five vulnerabilities added to CISA KEV after Flax Typhoon exploitation, and a critical Citrix NetScaler memory-overflow issue potentially allowing RCE or denial of service. It also highlights credential theft through malicious GitHub Actions workflows and browser extensions, iOS exploit-kit enhancements targeting keychains and crypto wallets, phishing,-

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
the_hacker_news
Record identifier
2f4ea049d6dd329aff359de60f6a9f0a9d599c2ed3f7f077c6f3848b48a1cc17
Enrichment time
2026-10-11T07:23:59Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.