Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
26 IOCs
Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft
Excerpt
Background A campaign offering free VPS services was actually a decoy. A page recovered from a public web archive shows that event[.]polarnode[.]vip, registered in late August 2026, declared https[:]//lk[.]wyincc[.]com/lk.js as a preload script and automatically loaded it once the page became interactive, without requiring visitors to click. After decoding the saved loader sample, we confirmed that it targets iPhones running iOS 18.4–18.6.2 via Safari only, ultimately…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →26 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | event.polarnode.vip | High | Score 58/100 | First seen |
| SHA256 | 78973b4d04cb6fee3c399937476347eca0aa9b99fa13596fe9dfaff829aba03b | Medium | Score 53/100 | First seen |
| URL | https://lk.wyincc.com/dist/sandbox.html?d=<URL-encoded | High | Score 58/100 | First seen |
| Domain | wyincc.com | High | Score 58/100 | First seen |
| SHA256 | 36b43f98c7f4d2d5a0f14ce8a5bdfd2fc055f8628da4a2d9ece2402385447f1e | Medium | Score 53/100 | First seen |
| SHA256 | 69e357f06ee87ea934b328c4e701d1d48dcfcef51352bb61c64ef89424c029d8 | Medium | Score 53/100 | First seen |
| IP | 166.117.225.238 | High | Score 58/100 | First seen |
| SHA256 | a5ebcbd5c744865535dd75d8742c99bc06b548dc2606ac6f116843b54451f73b | Medium | Score 53/100 | First seen |
| IP | 13.248.210.49 | High | Score 58/100 | First seen |
| SHA256 | f0409f0d1c134be43dcd697b4715cca64efa66e482d252744163f552050cd236 | Medium | Score 53/100 | First seen |
| Domain | polarnode.vip | High | Score 58/100 | First seen |
| SHA256 | 6eda3586102cf35ca53189accd2f56fec63a8adf74ccf93b59aed1e7651a690f | Medium | Score 53/100 | First seen |
| SHA256 | 892dd644ea9a10fd4d89c54d6cfe1028487c3fc23d3f29723af9004b6edf8c70 | Medium | Score 53/100 | First seen |
| SHA256 | 3a2341a13a7c4854bc203be18eebd11f716e043540a91974ef6d6d12253f6c9d | Medium | Score 53/100 | First seen |
| SHA256 | 52e2208a37c6dda971c9a67333dbcf526531745feb426a91ace9741ad178f510 | Medium | Score 53/100 | First seen |
| SHA256 | 693af544eb4deb194f481a870f1202fefb0c278820bb23bced85cd354d29a63e | Medium | Score 53/100 | First seen |
| IP | 66.117.225.238 | High | Score 58/100 | First seen |
| SHA256 | 38b43a6d27b08ff94a600fbe8182b4a2ba0eb744f68801a2d3454431f78e9fa5 | Medium | Score 53/100 | First seen |
| SHA256 | 78406a0c68043df99cea87f280e8307675c285ca9d88f5a56aa9901c6f503d11 | Medium | Score 53/100 | First seen |
| SHA256 | 953cfa9bf94304ad453eab706cd7cc92cde68eb6ea3c85652aa9040609e75f54 | Medium | Score 53/100 | First seen |
| SHA256 | 85ec8a4c83463565b3a517b6ee9d010fbf6643c49a67245c64b27bd8a0e43681 | Medium | Score 53/100 | First seen |
| SHA256 | 89912ab03eb2d02746e52df7b17035082d973234f249098caec11684e665c337 | Medium | Score 53/100 | First seen |
| SHA256 | afdb430bafc3c441ada98fe4a165fd1ad3a38ff5789517c5dd3f83a143706d53 | Medium | Score 53/100 | First seen |
| URL | https://lk.wyincc.com/lk.js | High | Score 58/100 | First seen |
| SHA256 | ab356a2bbdbb7f8e9327e10a2cf6d35ca0c4dbba06d982f559b00d13d31f3017 | Medium | Score 53/100 | First seen |
| URL | https://lk.wyincc.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…