Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft
Background A campaign offering free VPS services was actually a decoy. A page recovered from a public web archive shows that event[.]polarnode[.]vip, registered in late August 2026, declared https[:]//lk[.]wyincc[.]com/lk.js as a preload script and automatically loaded it once the page became...