BlockBeats says mobile web page was injected with an abnormal script; removal and remediation completed

AT A GLANCE

BlockBeats said that an article on its mobile web page was copied and injected with an abnormal script; it has now been removed and remediated, while the related vulnerabilities remain under investigation.

Article

Security Announcement Regarding an Abnormal Script Injected into the BlockBeats Mobile Web Page

BlockBeats reports that,October 24, this week, multiple security companies reported security vulnerabilities related to DarkSword to BlockBeats. After investigation, it was found that,October 22, an article titled “Global Market Risk-Off Sentiment…” on BlockBeats’ mobile web H5 page was copied by an attack team and injected with an abnormal script from a third-party domain. When users searched for this news item, the search page displayed both the original news item and a malicious news item containing the injected script. We reproduced the issue and completed its removal and remediation immediately after confirming it.

At the same time, because the effective exploitation window for the security vulnerabilities related to DarkSword was concentrated in the two version ranges of iOS 18.6–18.7.2 and iOS 26.0–26.1. We also remind all iOS users to promptly upgrade to the latest iOS 27 system.

Following the global PHP vulnerability incidents this week, BlockBeats has investigated more than dozens of related vulnerabilities, and technical staff are continuing their investigation.

It must be emphasized that BlockBeats has never supported any “wallet login” or “connect wallet” function. Any BlockBeats App requiring “wallet login” or “connect wallet” is a fraudulent third-party App. BlockBeats will further strengthen its review of and change management for third-party scripts, continuously monitor external resources loaded by pages, and improve its alerting and incident response procedures.

We would also like to thank security companies including SlowMist,GCSA for the assistance they provided at the earliest opportunity. We express our gratitude to everyone working on the front lines to maintain industry security.

Original link https://m.theblockbeats.info/flash/373484

Key points

The announcement said that multiple security companies reported security vulnerabilities related to DarkSword to BlockBeats this week.
The announcement said that October 22, on its mobile web H5 page, one article was copied by an attack team and injected with an abnormal script from a third-party domain.
The announcement said that when users searched for this news item, the search page displayed both the original news item and a malicious news item containing the injected script.
BlockBeats said it reproduced the issue and completed its removal and remediation.
The announcement said that technical staff had investigated more than dozens of related vulnerabilities and were continuing their investigation.
BlockBeats said it has never supported any “wallet login” or “connect wallet” function, and that any BlockBeats App requiring these functions is a fraudulent third-party App.
The announcement said that the effective exploitation window for vulnerabilities related to DarkSword was concentrated in iOS 18.6–18.7.2 and iOS 26.0–26.1, and reminded iOS users to upgrade to the latest iOS 27 system.
The announcement thanked SlowMist,GCSA and other security companies for their assistance.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

This notice describes a security incident in which webpages were copied and injected with abnormal third-party scripts. When searching for relevant news alerts, users may see both legitimate and malicious content. BlockBeats says the issue has been removed and fixed, but the overall investigation is not yet complete. The notice also emphasizes that it does not have wallet login or wallet connection functionality; any such entry point should be considered abnormal.

Why it matters to readers

The abnormal script and fraudulent wallet-connection entry could expose visitors to deception or security risks. Although the announcement said that the identified issues had been remediated, the investigation is continuing, so it remains unclear whether other pages are affected.

Do not connect a wallet, enter wallet credentials, or approve transactions on pages or apps claiming to be BlockBeats. Update your system promptly, and remain alert to duplicate or abnormal news alerts in search results.

Risks and unknowns

The notice does not state the number of affected users.
The notice does not confirm whether user data was leaked, wallet authorizations occurred, or funds were lost.
No independent technical verification has yet confirmed the scope of the vulnerability, the affected version range, or the effectiveness of the fix.
It remains uncertain whether the ongoing investigation will identify more affected pages or abnormal scripts.

BlockBeats says mobile web page was injected with an abnormal script; removal and remediation completed

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center