A campaign disguised as a free VPS service is targeting iPhone users running iOS 18.4 through 18.6.2 in Safari. SlowMist said the malicious site event[.]polarnode[.]vip loads scripts through a hidden iframe and deploys the six-CVE DarkSword chain, combining WebKit remote code execution, GPU and mediaplaybackd sandbox escapes, and kernel read-write capabilities. The activity can recursively collect application files and Keychain data, and capture keyboard input when imToken, TokenPocket or TronLink is open in the foreground. Apple has patched all six vulnerabilities, making the campaign a reuse of an n-day vulnerability chain. Visiting the page alone does not establish that mnemonic phrases or private keys were stolen; device forensics are required. SlowMist advised users to upgrade to iOS/iPadOS 18.7.3 or 26.3 and later and block wyincc.com, polarnode.vip and port 36887.