Threat video1:00
Mamont, Creduz, DarkSword Mobile Threats: Detection & IOCs
Mamont and Creduz droppers surged in Q3 2026 while DarkSword iOS exploits spread: 9 detection rules, 29 IOCs and a free Splunk SPL rule.
Read the full threat intel for Mamont, Creduz, DarkSword Mobile Threats: Detection & IOCs →
Chapters
- 0:00The hookAbout 378,456 malicious Android packages rose.
- 0:07The storyBanking trojans led at 31.63%.
- 0:13Attack path13 Packagist theme packages delivered the iOS chain.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise17 indicators to hunt: 2 domains, 1 URL and 13 package names, and more.
- 0:39MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to exfiltration.
- 0:44Remediation5 steps now: Update iOS to the latest release.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 378,456 malicious Android packages rose.
0:07Banking trojans led at 31.63%.
0:11Preinstalled Triada led the list.
0:1413 Packagist theme packages delivered the iOS chain.
0:18Then DarkSword, a six-vulnerability iOS chain, redeployed in August.
0:23A keychain stealer targets crypto wallet seeds.
0:28No threat actor is attributed. Confidence: low.
0:3317 indicators to hunt: 2 domains, 1 URL and 13 package names, and more.
0:4018 ATT&CK techniques, from initial access to exfiltration.
0:445 steps now: Update iOS to the latest release.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.