Decision RecordActivePublished without chair review
CRT-2026-040820 Oct 2026MORNING EDITIONDaily Roundtable
DarkSword response for high-value mobile users
Preserve and network-isolate suspected phones, move affected users to clean devices, invalidate sessions, rotate service credentials from trusted systems, and migrate exposed wallet assets to newly generated keys.
Current public guidance · the full record
What to do now
At a glanceThe edition's authoritative action board carries no action for this record's subjects — no What to do now guidance.
Why now
WeakAs of the October 20, 2026 replay cutoff, the reviewed analysis reported a complete Safari-based DarkSword exploitation chain, ten compromised iPhones, and wallet-focused exfiltration events from nine devices.
Those reported compromises justify immediate preservation, isolation, account recovery, and wallet protection rather than waiting for version-specific scoping. The evidence supports prompt action but not a mandatory 24-hour completion target.
Who is affected
WeakCryptocurrency personnel using an iPhone suspected of DarkSword compromise face potential exposure of wallet data and assets.
Privileged or other high-value users with active service sessions or credentials on a suspected iPhone face potential account and session exposure.
Security and incident-response teams supporting these users must preserve the phone for investigation while containing its network access and conduct recovery from a clean system.
The bounded evidence names no iPhone model or iOS version, so the scope is based on suspected compromise rather than a version list.
What supports this
Partially supportedSupport — The DarkSword campaign handoff identifies an iPhone attack kit targeting cryptocurrency wallets.
Support — The malware analysis reports a complete Safari-based exploitation chain, ten compromised iPhones, and wallet-focused exfiltration events from nine devices.
Support — The evidence assessment confirms that the reviewed analysis recommends preserving suspected phones while network-isolated, using a known-clean device to invalidate sessions and credentials, and moving exposed wallet assets to newly generated keys.
Support — The October 20, 2026 final synthesis prioritizes confirmed mobile infection over vulnerability scores and recommends clean-device recovery and trusted-system credential rotation for potentially exposed cryptocurrency personnel.
How the Roundtable reached this
Under reviewThe decision scout identified a concrete containment and recovery path after reviewing reports of a complete Safari-based DarkSword exploitation chain, ten compromised iPhones, and wallet-focused exfiltration events from nine devices.
The evidence auditor confirmed support for preserving and network-isolating suspected phones, moving users to clean devices, invalidating sessions, rotating service credentials from trusted systems, and moving exposed wallet assets to newly generated keys.
The auditor separately found no evidentiary basis for completing the device hunt within 24 hours, so that deadline was removed. The boundary reviewer found the precautionary guidance publicly safe.
The linker found no bounded prior record to update, and the arbiter selected a new operational decision record without a fixed response deadline.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 11 candidate signals.
- Linker (AI panel role)Linker evaluated 11 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 24 evidence signals; 12 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 0 predictions and rejected 2 claims.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 16 public/private findings.
- Arbiter (AI panel role)Arbiter produced 11 decision envelopes.
Key disagreement
Scout (AI panel role)
The evidence supports wallet-data collection and transfer, but it does not by itself establish cryptocurrency theft or a technical link to AdFection. | Merged related signal (candidate-9): What protection and investigation should be applied to people matching reported AdFection targeting?
Arbiter outcome
Arbiter outcome: new decision record. The operational response to suspected mobile compromise is strongly supported, publicly safe, and does not depend on the unsupported response deadline.
Candidates considered
Considered 11 candidates · opened 1 · 10 not opened (10 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
MissingThe evidence supports wallet-data collection and transfer, but it does not establish that cryptocurrency was stolen.
It also does not establish a technical link between DarkSword and AdFection. The packet does not identify affected iPhone models or iOS versions, so exposure cannot be narrowed by version. Prompt action is supported, but the proposed 24-hour completion deadline is not.
What evidence is missing
ConflictingThe bounded packet does not include the underlying primary campaign reports or separate authoritative citations needed to verify the reported ten compromised iPhones and nine wallet-focused exfiltration events directly.
It also lacks affected iPhone models, iOS versions, device-level indicators, and a supported reason for a 24-hour hunt deadline. Evidence proving cryptocurrency theft or a technical connection between DarkSword and AdFection is also absent.
What would change this
Under reviewAuthoritative forensic evidence that a suspected iPhone was not compromised and did not expose sessions, service credentials, or wallet material would narrow the recovery actions for that device.
Reliable affected-version or indicator data would replace the current suspicion-based scope with targeted hunting. Evidence supporting a specific response interval could add a fixed deadline.
Proof of cryptocurrency theft would change the wallet concern from precautionary exposure containment to response to confirmed loss, while proof of a DarkSword–AdFection technical link would broaden the campaign scope.
What to watch next
WeakExamine preserved suspected iPhones for DarkSword-specific artifacts, staged wallet data, or command-and-control activity.
Finding any of these should trigger device retirement or rebuilding and migration of exposed wallet assets to newly generated keys.
Also watch for authoritative reporting that supplies affected iPhone models, iOS versions, device indicators, or a supported response deadline; use those details to narrow the device hunt or set a defensible completion target.
Evidence basis
**AdFection:** Delivery is established: Discover-Tech’s advertising platform profiled devices and caused selected devices to contact Candiru/Integrity Labs infrastructure when an advertisement rendered—no click required. Exploitation and ex…
Summary: This is not a generic patch day: confirmed compromise, successful unauthorized sessions, tampered updates, or mobile infection must outrank vulnerability scores alone. Unit 42 reporting and CISA’s KEV listing make the UNC5820 Forti…
Public value history
- 20 Oct 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableMorning roundtableConvened 20 Oct 2026Methodology
How the panel reaches a Public Decision Record.