AAPL News & Signals

meme5h agomeme

@0x7_anderson one year already? 💜 Reply to @0x7_anderson: . Using the https://t.co/SeggMJqkd8 card for everyday spending: a non-custodial Visa card that lets you spend USDC or borrow against ETH without having to sell it. Up to 3% cashback in ETHFI, Apple Pay/Google Pay support, and my funds remain under my control. Practical and straightforward. .Honestly, I think it's one of the best crypto cards available today. I've been using it daily and have never had any issues. . The 3% cashback arrives the same day. Crypto deposits are instant, and you can also make regular bank transfers without any problems. lI'll leave my referral link below for anyone who's interested: https://t.co/SOmvYqrYdx This isn’t a paid partnership. I’m sharing it because i genuinely think it’s a great product. @ether_fi @MikeSilagadze

35/100·CLong+5

news5h agonews

Apple: Siri AI Currently Unavailable in EU; Working with EU on Path Forward - Website

72/100·B+Short

Hanami7h agonews

Getting funds into LAB shouldn't be a side quest Use Google Pay to top up your balance and get straight to business Apple Pay for iOS users. Coming soon 🔔

10/100·CNeutral+1

twitter7h agomeme

*APPLE IPHONE DUO DRAWS EARLY COMPLAINTS OF THE SCREEN CRACKING

55/100·BShort

oi_change7h agomarket

AAPL/USDT OI 5min Down 8.22% $219K dropped to $201K, Price -0.34%, Long Liquidation

news10h agonews

Apple unveils new iPad mini with OLED display and faster A20 Pro chip

55/100·BLong

meme11h agomeme

💜 Reply to @solana: Finalized before you finish reading this sentence. Alpenglow cut Solana’s finality to ~150ms, J.P. Morgan brought its tokenized money market funds onchain, and a tokenized stock did twice as much volume on Solana as on traditional exchanges. Here’s what shipped: 📰 Headline News - @anza_xyz shipped Alpenglow, slashing finality to ~150ms in Solana's biggest consensus upgrade yet - @JPMorganAM’s tokenized money market funds went live on Solana - @xStocksFi’s VIDAx did 2x the volume on Solana vs traditional exchanges over 30 days 📰 Launches - Tokenized $TSLA, $META, and $AAPL went live via @sunrise, issued by @BackpackOnchain - @JupiterExchange embedded native swaps into @DecryptMedia - @1inch enabled trading for @Ondo's 450+ tokenized equities and ETFs on Solana - @reflectmoney Create went live, enabling launch of custom yield-split stablecoin - @BlockRunAI activated Zero Data Retention for privacy-first AI inference - @birdeye_data launched Peak, a unified digital asset terminal for institutions - @orca_so added Adaptive Fee profiles, featuring dynamic "Launch Spike" and "Quick Reset" curves - @altitude shipped multi-entity support for unified corporate treasury and card management - @listendotmoney debuted a vibe trading platform powered by AI agents for research and execution - @MeteoraAG overhauled its DAMM v2 UI with max slippage controls and split-liquidity tools - @alienorg integrated Solana Attestation Service to launch Proof of Human identity - @openappsxyz launched AdPad, a USDC-settled peer-to-peer ad marketplace - @Beezie opened Base-to-Solana migration for collectibles and wallet funds - @Gableguardians shipped its free-to-play mobile game on @Android - @peopledotfun opened the waitlist for its conviction trading platform 📰 Milestones - Tokenized stock holders on Solana crossed 1.5M unique addresses - Solana processed 8.92B successful non-vote txs in Q3 2026, up 104% from Q4 2025 - @humafinance processed $20B in payment volume, up nearly 3x YoY - @Backpack Securities crossed $6B in cumulative volume - @sunrise cleared $15B in total volume in under a year - @Collector_Crypt recorded its biggest day yet with $24.3M gross revenue and 123K+ packs opened - @solanamobile's dApp Store crossed 1,500 live apps - @kamino’s AUTO Market surged 8x in a month, passing $170M in deposits - Tokenized $SKHY via @sunrise surpassed $500M in cumulative volume - @Raydium LaunchLab distributed tokenized stocks to 300K+ unique holders - @solflare and @PhoenixTrade's wallet perps integration crossed $200M in volume - @GrailBreak hit $1.5M in trading volume - @hylo_so closed a $1M strategic round led by @SolanaVentures with participation from @colosseum - @useDiversiFi climbed past $500K in total value locked Three weeks to Breakpoint, and the next wave of speakers is confirmed. The City of London, the NYSE, the NBA, and the World Series of Poker, all on one stage. Artwork by @doodles 🔥

78/100·ALong+17

meme11h agomeme

Premarket movers: Mag 7 stocks are mostly higher: Meta Platforms (META) up +2.4% after announcing sale of up to $95 billion in common and preferred stock; Tesla (TSLA) gains 1.8% as Barclays upgrades to overweight from equal-weight, citing M&A opportunity with SpaceX; Alphabet (GOOGL) +0.5%, Amazon (AMZN) +0.2%, Microsoft (MSFT) +0.4%, Nvidia (NVDA) +0.4%, Apple (AAPL) -1.7%. US-listed shares of Brazilian companies, and those exposed to the country, slump after President Luiz Inácio Lula da Silva surprised the markets to come from behind to win a runoff election. Among movers: PagSeguro (PAGS) -32%, NU Holdings (NU) -25%, MercadoLibre (MELI) -14% ArriVent Biopharma (AVBP) is trading higher by 4.5% after early-stage data for the company’s ARR-217 product candidate was presented at ESMO, a key cancer conference. Booz Allen Hamilton Holding Corp. (BAH) rises 0.9% as it is being upgraded to buy from hold at TD Cowen, which writes that shares of the IT services company look attractively valued in the wake of long-term share-price weakness. Borr Drilling shares (BORR) drop 8.2% after the company said search and rescue operations are ongoing for five individuals who remain unaccounted for after its Prospector 5 drilling rig sank during jacking operations offshore Gabon on Oct. 24. Coinbase Global Inc. shares (COIN) are down 1.7% as Bernstein cut its price target on the exchange to $250 from $330 on lower expected crypto volumes. Equifax Inc. (EFX) falls 3.5% after it was cut to sector perform from outperform with RBC saying the the recent stock rally “off the lows has left risk/reward more balanced” given concerns on higher rates, regulatory overhand and consumer lending pressure. Fair Isaac Corp. (FICO) falls 9.2% after it was cut to equal-weight from overweight at Wells Fargo, citing its lower-than-expected 2027 pricing announcement. FirstEnergy Corp. shares (FE) rise 0.5% after BMO Capital Markets initiated coverage of the utilities company with a recommendation of outperform as it sees an attractive valuation. Lockheed Martin Corp. shares (LMT) are up 1.4% after Morgan Stanley upgraded the defense company to overweight from equal-weight, writing that a recent deal for F-35 fighter jets “takes significant risk out of the stock.” Moderna (MRNA) slumps 8.2%, set to extend their decline for a third session, after the drugmaker gave results from a trial of its experimental vaccine used in the treatment of pancreatic cancer. Nutanix Inc. shares (NTNX) are up 5.3% after Guggenheim Securities started coverage on the infrastructure software company with a buy rating and $100 price target, seeing an ability for it to take market share. Range Resources (RRC) rises 8.9% after EQT (EQT -8.1%) agreed to buy the energy firm in an all-stock transaction to create a combined natural gas company with a pro forma enterprise value over $50 billion. Spotify Technology SA shares (SPOT) are down 1.4% after Phillip Securities downgraded the audio-streaming company to accumulate from buy, a move that comes in the wake of its recent results. Xencor (XNCR) climbs 31% after the drug developer gave updated results from an early-stage trial of its experimental drug for kidney cancer that impressed Wall Street.

72/100·B+Long+27

meme10/25meme

More reference control. Fewer denoising steps. More places to run H3. The latest community contributions span 8-step reference-conditioned video + audio, 4-step distillation, sparse attention, and reference-token compression - alongside serving and workflow integrations across GPU servers, TPUs, and Apple Silicon. What matters is what this enables: more affordable experimentation, finer creative control, and more choices about where and how video generation runs. Open models become more useful when the community can improve the methods, adapt the runtime, and build workflows around them. Credit to @haoailab @yisun0618 @lanfeng491270 @guocheng_qian @Alissonerdx @ddalcu @tazmannner @HaochengXiUCB @huggingface @Jhuaplin, and the PTD, DMAD, SparkH3, TorchTPU and FlashML teams - including Zhengming Yu and zechengtang on GitHub. 11 additions to the H3 ecosystem index. Thank you to everyone building, testing, and sharing. https://github.com/MiniMax-AI/awesome-minimax-h3-integration Quoted @MiniMax_AI: Open weights. Shared progress. MiniMax H3 is moving fast. We built H3 for video generation with native stereo audio and multimodal reference control. The open-source community is making that capability faster, more accessible, and easier to build on. Recent highlights: • FastH3 — FastVideo, Nuva Lab and NVIDIA: 4-step distillation, now running on DGX Spark and Apple Silicon. • Sol-H3 — NVIDIA’s SANA team: 15 seconds of 768p video + audio in 6.6 seconds on 8×B300, in the team’s warm-inference benchmark.* • VDN — Haocheng Xi and the OpenVDN team: rethinking attention for faster H3 inference, with weights, training and inference code released. • PDD — NVIDIA’s distillation method, brought to H3 by Alibaba PAI as 8-step Acc-LoRAs, now supported in ComfyUI. • LightX2V — 4- and 8-step Turbo LoRAs, with workflows for text, image and reference-conditioned video + audio. Behind every release are people training, optimizing, quantizing, testing and sharing. Special thanks to: @haoailab @nuvalab @NVIDIAAI @xieenze_jr @HaochengXiUCB @ArashVahdat @julberner @LightX2V @ComfyUI And to the individual contributors pushing the work forward: @haozhangml @cxlcl1 @lawrence_cjs @yitongli165665 @haopengl33 @songhan_mit @shanasaimoe Thank you for building with H3 and helping make it faster, more accessible, and more useful for the community. Powerful models go further when we build together. Keep pushing H3. Excited to see what comes next. 🚀 Explore the ecosystem: https://github.com/MiniMax-AI/awesome-minimax-h3-integration(Historical earnings: For fiscal 2026Q1 (period ended 2026-03-28), Intel reported basic and diluted EPS of -0.73 and net income of USD -3.728 billion, compared with basic and diluted EPS of -0.19 and net income of USD -0.821 billion in the prior-year 2026Q1 period (ended 2025-03-29). For full-year 2025 (ended 2025-12-27), basic and diluted EPS were -0.06 and net income was USD -0.267 billion, versus basic and diluted EPS of -4.38 and net income of USD -18.756 billion in full-year 2024. Consensus expectations: For the upcoming 2026Q3 event on 2026-10-29, consensus EPS is 0.3945 and consensus revenue is USD 16.447 billion.)

20/100·CNeutral+14

meme10/25meme

Taiwanese media report that the iPhone Duo is selling like hotcakes, prompting Apple to ask suppliers to ramp up production and increase orders by 30% to meet market demand. All iPhone Duo models reportedly sold out on launch day, with the next batch of shipments not expected until January 22, 2027. https://money.udn.com/money/story/5612/9836711

78/100·ALong

news10/25news

WEDNESDAY MAY BE THE BUSIEST DAY OF THE QUARTER

On Wednesday of this week we have

- Fed Interest rate decision and Kevin Warsh FOMC press conference
- Apple $AAPL new product event
- Earnings from Google $GOOGL, Microsoft $MSFT, ServiceNow $NOW, Chipotle $CMG Fortinet $FTNT, KLA Corp $KLAC, FedEx $FDX, Ford $F, and much more
- I will be at a secret all day event for one of the largest public companies 👀

My full catalyst watch for the week is below ... make sure you are ready for the week ⬇️⬇️(Historical earnings: Latest disclosed actuals are for 2026Q2 (period ended 2026-06-30): basic EPS of 14.41, diluted EPS of 14.24 and net income of USD 174.771 billion. Consensus expectations: Consensus for 2026Q3 expects EPS of 3.0047 and revenue of USD 127.853 billion.)

35/100·CLong+6

news10/25news

Finalized before you finish reading this sentence. Alpenglow cut Solana’s finality to ~150ms, J.P. Morgan brought its tokenized money market funds onchain, and a tokenized stock did twice as much volume on Solana as on traditional exchanges. Here’s what shipped: 📰 Headline News - @anza_xyz shipped Alpenglow, slashing finality to ~150ms in Solana's biggest consensus upgrade yet - @JPMorganAM’s tokenized money market funds went live on Solana - @xStocksFi’s VIDAx did 2x the volume on Solana vs traditional exchanges over 30 days 📰 Launches - Tokenized $TSLA, $META, and $AAPL went live via @sunrise, issued by @BackpackOnchain - @JupiterExchange embedded native swaps into @DecryptMedia - @1inch enabled trading for @Ondo's 450+ tokenized equities and ETFs on Solana - @reflectmoney Create went live, enabling launch of custom yield-split stablecoin - @BlockRunAI activated Zero Data Retention for privacy-first AI inference - @birdeye_data launched Peak, a unified digital asset terminal for institutions - @orca_so added Adaptive Fee profiles, featuring dynamic "Launch Spike" and "Quick Reset" curves - @altitude shipped multi-entity support for unified corporate treasury and card management - @listendotmoney debuted a vibe trading platform powered by AI agents for research and execution - @MeteoraAG overhauled its DAMM v2 UI with max slippage controls and split-liquidity tools - @alienorg integrated Solana Attestation Service to launch Proof of Human identity - @openappsxyz launched AdPad, a USDC-settled peer-to-peer ad marketplace - @Beezie opened Base-to-Solana migration for collectibles and wallet funds - @Gableguardians shipped its free-to-play mobile game on @Android - @peopledotfun opened the waitlist for its conviction trading platform 📰 Milestones - Tokenized stock holders on Solana crossed 1.5M unique addresses - Solana processed 8.92B successful non-vote txs in Q3 2026, up 104% from Q4 2025 - @humafinance processed $20B in payment volume, up nearly 3x YoY - @Backpack Securities crossed $6B in cumulative volume - @sunrise cleared $15B in total volume in under a year - @Collector_Crypt recorded its biggest day yet with $24.3M gross revenue and 123K+ packs opened - @solanamobile's dApp Store crossed 1,500 live apps - @kamino’s AUTO Market surged 8x in a month, passing $170M in deposits - Tokenized $SKHY via @sunrise surpassed $500M in cumulative volume - @Raydium LaunchLab distributed tokenized stocks to 300K+ unique holders - @solflare and @PhoenixTrade's wallet perps integration crossed $200M in volume - @GrailBreak hit $1.5M in trading volume - @hylo_so closed a $1M strategic round led by @SolanaVentures with participation from @colosseum - @useDiversiFi climbed past $500K in total value locked Three weeks to Breakpoint, and the next wave of speakers is confirmed. The City of London, the NYSE, the NBA, and the World Series of Poker, all on one stage. Artwork by @doodles 🔥

78/100·ALong+20

meme10/25meme

This is another rebuttal to claims that CXMT will dump memory at rock-bottom prices. According to Taiwanese media reports, a Taiwanese server manufacturer held discussions with CXMT about purchasing DDR5, but CXMT declined to sell to them. The manufacturer said CXMT is different from the typical Chinese companies that have indiscriminately slashed prices and flooded markets with supply across industries such as solar and batteries. A veteran industry analyst also told Taiwanese media that Apple had approached CXMT for pricing, only to find that its memory was just as expensive as that of the three major suppliers—and that CXMT had no intention of lowering its prices. https://technews.tw/2026/10/25/nanya-2028/

72/100·B+Long+3

meme10/24meme

How Sundar Pichai uses AI to run Google: "I have agents running internally for me... There are all these chat groups: pre-training, mid-training, post-training data, etc. It could easily take me an hour a day to catch up on what's happened in the last 24 hours, but now I have agents running that summarize and bring that information to me. I can still go deeper, and I do so often. Similarly, there are agents with telemetry into our compute usage, product areas, efficiency, and utilization, and they are giving me inputs and insights." Quoted @alexeheath: Sundar Pichai on Gemini 4 and the AI compute crunch Even Google can’t get enough compute. I sit down with Google and Alphabet CEO @sundarpichai shortly after the wider release of Gemini 4 Argon to discuss its early reception, where he still wants the model to improve, and what it takes to keep Google at the frontier of AI. Pichai explains the recent leadership shakeup at Google DeepMind and why building frontier models has become an “all-consuming” job. We also get into Google’s answer to the personal agent race, how he predicts Gemini will do more work on your behalf, and whether agents will finally bring Search, Gmail, and Gemini together. I ask him about Google turning free cash flow negative, the risks in the AI infrastructure buildout, and how he plans for demand years before knowing what the models will be capable of. He explains the signals giving him confidence to keep spending and how he uses AI agents to follow model development and compute usage inside Google. Timestamps: 00:00 Gemini Argon launch reception 01:49 Model access and safety 06:20 The AI model race 08:35 Agentic breakthroughs and 2027 11:34 Recursive self-improvement 15:41 DeepMind leadership changes 19:52 Google's AI compute investments 25:20 Is AI spending sustainable? 33:18 How Sundar uses AI agents 35:35 Gemini's personal agent plans 38:37 How AI agents change the web 43:52 Google's space data centers 47:38 Waymo's expansion strategy 50:26 Wing's drone delivery plans 51:36 AI safety and regulation 55:58 Google's quantum computing bet YouTube: youtu.be/fJBSNEFdm8c Spotify: open.spotify.com/episode/0cJBqm… Substack: sources.news/p/sundar-picha… Apple Podcasts: podcasts.apple.com/us/podcast/sun… This episode's presenting sponsor is @hyperagentapp. Thanks to the show’s premiere sponsors: @Atlassian, @meetgranola, and @mercury.

35/100·CLong+5

meme10/24meme

So back on your Neoclouds like $NBIS + memory read through... From $AMZN CEO + A16z interview. Q: On memory shortages (eg. $MU / SK Hynix / Samsung): A: "There's only so much memory, and I don't think that that shortage ends in 2027." Q: On AWS capacity: A: "A good chunk of 28 is sold out", "largely sold out through 2027." Q: On capex ROI: A: Amazon had said it would spend about $220 billion in capex for 2026. But Jassy said the company "could invest a lot more and it wouldn't be a bad use of capital" This is probably validating economics of Neoclouds model since this comes from a pretty stingy hyperscaler like Amazon... that only serves free bananas to their employees. Unlike trusting $META / Zuck where you the guy throws all you can eat cruise ship type buffets at every employee. - AWS claims approximately 30-40% better price-performance than comparable AI accelerators. Then went on to say Annapurna was "one of the very best acquisitions we've done in Amazon and the history of the company, if not the best." "We spun out a separate team in Annapurna to build an AI accelerator" Just to give a bump to your AI custom silicon type private companies (since others like $AAPL were likely going on shopping sprees). TLDR: - Not really too much groundbreaking, just incremental validation of what was said previous earnings. - Broader shortages (like memory) won't end in 2027 - Always positive to hear from $AMZN on insatiable demand + ROI given atrocious Neocloud sentiment right now(Historical earnings: For fiscal 2026Q1 (period ended 2026-03-31), Amazon reported basic EPS of 2.82, diluted EPS of 2.78, and net income of USD 90.798 billion, versus basic EPS 1.62, diluted EPS 1.59, and net income USD 65.944 billion in the prior-year period (ended 2025-03-31). For full-year 2025 (ended 2025-12-31), basic EPS was 7.29, diluted EPS 7.17, and net income USD 77.670 billion, versus basic EPS 5.66, diluted EPS 5.53, and net income USD 59.248 billion in 2024. Consensus expectations: For the upcoming 2026Q3 event on 2026-10-29, consensus EPS is 1.9573 and consensus revenue is USD 202.162 billion.)

72/100·B+Long+14

news10/24news

Inside the iOS Exploit Underground: Crypto Theft Executive Summary Since late 2025, a cybercrime ecosystem has rapidly taken shape around a clear objective: exploit vulnerabilities in older iOS versions to steal Web3 private keys and crypto assets. At its core are two nation-state-grade, full-chain iOS exploit kits: Coruna, covering iOS 13.0–17.2.1, and DarkSword, covering iOS 18.4–18.7. Within a single year, both passed from commercial surveillance vendors to state-sponsored threat actors and then to cybercriminal groups. The source code leak in March 2026 opened the floodgates. Security industry telemetry now shows roughly 17,000 domains hosting second-generation variants of the two toolkits. The ecosystem has already matured into an end-to-end criminal supply chain: - Upstream: Zero-day exploits are brokered and resold. - Midstream: Turnkey malware clients and admin panels are openly sold on Telegram. - Downstream: Operators distribute attacks through watering-hole sites, spoofed pages, QR-code phishing, supply-chain hijacking via expired domains, and even trojanized apps that pass Apple’s official App Store review. This report dissects that supply chain: the technical components of its arsenal, each stage of the attack chain, the division of labor and flow of funds, and the steps users should take during the current window of exposure. I. The Cost of Unpatched iOS: How the Attack Surface Takes Shape 1.1 The Patch Gap and the Legacy Device Base In this report, “outdated” refers to unpatched operating system versions, rather than the age of the hardware. The iOS security model rests on an ideal assumption: users install updates promptly. In practice, that assumption fails systematically at three levels. First, devices reach their upgrade ceiling. The iPhone X and earlier models top out at iOS 16, while older generations are limited to iOS 15. These devices will never receive new patches, creating a vulnerable installed base—and a market for exploitation—that only grows. Second, the patch gap creates an opportunity for attackers. The day a security fix is announced is often also the day the attack becomes public. For users who do not update, a gulf separates “officially patched” from “actually protected”—one wide enough for criminal operators to harvest victims on an industrial scale. Third, version-specific exploit development has become systematic. Modern exploit kits no longer rely on a single vulnerability working across every iOS release. They package separate exploit code for each version and select the appropriate code at runtime. Version diversity is no longer an obstacle. It turns outdated releases into a target list operators can systematically enumerate. 1.2 Why Private Keys Are a Priority Target The economics are straightforward. Stolen bank credentials still leave attackers facing fraud controls, transfer limits, and account freezes followed by appeals. Crypto seed phrases and private keys offer four distinct advantages: - Hard to freeze: No central authority can arbitrarily reverse an onchain transfer. - Rapid monetization: Assets can be moved in seconds. - High value per device: Crypto holdings on a single mobile device often range from tens of thousands to millions of dollars. - No victim confirmation required: The entire theft can proceed without the victim confirming anything. Another factor is often overlooked: user behavior. A substantial share of crypto holders keep screenshots of their seed phrases in photo libraries, copy them into notes, or save them in chat bookmarks. For attackers, these are goldmines. This is no coincidence. It reflects deliberate, detailed research into how users store the secrets that control their assets. II. The Exploit Arsenal: Attack Chains and Trojanization Cases 2.1 Coruna: An Exploit Toolkit Spanning iOS 13–17 Publicly disclosed on March 3, 2026, Coruna—previously tracked within the mobile security industry as CryptoWaters—covers the widest range of iOS versions of any publicly documented exploit toolkit. It packs five complete exploit chains and 23 individual exploits, covering every release from iOS 13.0, launched in September 2019, through iOS 17.2.1, released in December 2023. It supports both arm64 and arm64e architectures. Industry estimates put its development cost at $30 million–$40 million. This is not something an ordinary attack team could build. Its developers could be called professional arms dealers of the digital age. The vulnerability matrix below breaks down the toolkit by attack stage. Two exploits used for privilege escalation and PPL bypass—Photon and Gallium—are the same ones used in Operation Triangulation in 2023. Their appearance in both operations provides direct evidence of advanced exploit technology circulating between threat actors. The JavaScript framework uses a minimal but distinctive obfuscation scheme: both strings and integers are XOR-encoded and decoded only at runtime. Resource URLs never appear directly in the code. Instead, they are derived from a hardcoded cookie using sha256(COOKIE + ID)[:40]. Later-stage binary payloads are delivered under .min.js paths to disguise their contents. A custom file format begins with the magic value 0xf00dbeef and uses per-blob ChaCha20 encryption with independent keys, alongside LZW compression. Each payload carries metadata specifying the chipsets and iOS versions it supports. If exploitation fails, the toolkit proactively deletes crash logs associated with com.apple.WebKit.WebContent, powerd, and panic to minimize forensic traces. At the end of the chain sits PlasmaLoader, an implant identified as com.apple.assistd, which injects into the powerd daemon running as root. The core payload is then injected into locationd, imagent, and SpringBoard. The first serves as the coordination hub; the latter two handle an SMS-based fallback communications channel and interaction with the device’s home screen, respectively. The module list reveals the operation’s real objective. The implant retrieves a JSON configuration packaged in an encrypted 7z archive from http:///details/show.html. Stealer modules are then dynamically delivered based on the apps installed on the victim’s device. Public research has reconstructed the following configuration excerpt: There are 18 such modules, targeting major wallets including BitKeep, Bitpie, Coin98, Coinbase, Exodus, imToken, Krystal, MetaMask, MyTonWallet, Phantom, Skymavis, Solflare, Tonhub, Tonkeeper, TronLink, Trust Wallet, and Uniswap. Beyond these wallet-specific modules, the payload has three capabilities worth remembering: Photo-library scanning and QR-code decoding: It reads every image in the photo library and decodes embedded QR codes to extract addresses and private keys. Apple Notes scanning: It searches the full text of notes, matching against the BIP39 wordlist and keywords such as “backup phrase,” “备份短语” (“backup phrase”), and “银行账户” (“bank account”), then uploads matching content. Social-app communications interception: It hijacks communications data from WhatsApp and other social apps. Traces of further development by cybercriminal operators are equally clear. Logs inside the stealer modules are in Chinese—for example, %s[%d]: CorePayload 管理器初始化成功，尝试启动... (“CorePayload manager initialized successfully, attempting to start…”). Some comments contain emoji, and the writing style strongly suggests LLM-generated text. One example is the heartbeat initialization message “✅ 心跳监控已启动” (“✅ Heartbeat monitoring started”). For exfiltration, data is encrypted with AES, using the SHA-256 hash of a fixed string as the key, and sent back through POST requests. Some requests include custom sdkv and x-ts headers. If the hardcoded C2 endpoint becomes unavailable, the malware falls back to a domain generation algorithm (DGA) seeded with the string lazarus. It generates .xyz domains with 15-character labels and uses public DNS resolution to check whether they resolve successfully. Coruna’s path through the threat ecosystem unfolded in three stages: February 2025: Security researchers first captured portions of the exploit chains being used by a customer of a commercial surveillance vendor. Summer 2025: UNC6353, a suspected Russia-linked espionage group, deployed the toolkit in watering-hole attacks targeting Ukraine. The group compromised websites in the industrial equipment, retail, and e-commerce sectors, embedding hidden iFrames pointing to cdn.uacounter[.]com/stat[.]html. The exploits were served only to iPhone users from selected geographic locations. Late 2025–early 2026: Financially motivated group UNC6691 deployed the same toolkit indiscriminately across numerous Chinese-language sites impersonating financial and crypto services. These fake exchanges and airdrop pages explicitly told visitors: “This page supports iOS devices only. Please visit using an iPhone or iPad”—precisely filtering for their intended victims. 2.2 DarkSword: Built for iOS 18, Entirely in JavaScript Jointly disclosed by several security organizations on March 18, 2026, DarkSword targets iOS 18.4–18.7 and was first observed in the wild in November 2025. Its defining design difference from Coruna is that every stage, including the final payload, is implemented in JavaScript. This sidesteps two of Apple’s toughest kernel mitigations: PPL (Page Protection Layer) and SPTM (Secure Page Table Monitor). These mitigations target the execution of unsigned native code; an all-JavaScript payload does not need to execute unsigned native code. The complete chain uses six CVEs, three of which were being exploited as zero-days when first observed. The landing page first checks the uid key in sessionStorage to prevent repeat infections, then inserts a hidden iFrame to load frame.html. That page uses document.write to include rce_loader.js. The loader retrieves the appropriate rce_worker_18.x.js for the device’s iOS version and runs the exploit logic in a Web Worker, coordinating with the main thread through postMessage. When Chrome is detected, the page redirects the user to Safari through the x-safari-https:// protocol handler—indicating that this chain has only a WebKit implementation. Bugs in the loader are revealing: some operators implemented version checks incorrectly and served the same exploit to every device; others did not even realize iOS 18.7 had already been released. These rough edges point to code that has changed hands repeatedly, with buyers of varying skill levels making their own fixes. Public research documents three early deployments: November 2025: UNC6748 targeting Saudi users. The group used snapshare[.]chat, a site impersonating Snapchat, to deliver GHOSTKNIFE, a JavaScript backdoor. It uses a custom binary protocol with ECDH and AES and can steal account data, messages, location data, audio recordings, and screenshots. During execution, it writes intermediate files to /tmp/./STORAGE and periodically deletes crash logs associated with mediaplaybackd, SpringBoard, com.apple.WebKit., and panic-full-. November 2025: PARS Defense operating in Turkey. The Turkish commercial surveillance vendor showed markedly better operational security (OPSEC). Its loader and all subsequent stages were obfuscated, and exploit delivery was encrypted throughout using ECDH and AES. In January 2026, another customer of the vendor operated in Malaysia. That deployment added an extensive set of device-fingerprinting checks to the landing page: Apple Pay availability, the standalone property, CSS backdrop-filter support, WebGL2, whether the Vibration API is present, and debugger detection. It deployed the GHOSTSABER backdoor, which supports 17 command types, including arbitrary SQLite queries, file exfiltration, and EvalJs. From December 2025: UNC6353 targeting Ukraine. The previously discussed group incorporated DarkSword into its watering-hole campaign through static.cdncounter[.]net/widgets.js. Its payload, GHOSTBLADE, is a comprehensive data harvester. It steals iMessage, Telegram, and WhatsApp databases, keychain contents, Wi-Fi passwords, photos, notes, crypto wallet data, Safari browsing history, and even health data. Based on its coding style and the depth of its library integration, researchers assess that GHOSTBLADE was most likely written by DarkSword’s original developer. Paths left in the webpack bundle also exposed an internal development framework named TaskRop and a reference to an unimplemented startSandworm() function. 2.3 Evolution After the Leaks: P7, Hybrid Variants, and gooll In March 2026, Coruna samples and decoded payloads appeared on GitHub, followed by readable source code for the entire DarkSword exploit chain. Section 4.1 provides the repository timeline. Over the subsequent months, criminal development of the two toolkits proceeded along three tracks. The first was substantial reengineering. Disclosed in early October 2026, the P7 DarkSword variant—named after the p7_ variable prefix in its code—removed HTTP and syslog debug logging. Instead of uploading the entire keychain database for server-side decryption, it extracts the data into JSON on the device before exfiltrating it. It also added bidirectional C2 with a 15-second heartbeat and 17 remote commands, including wallet_scan, wallet_extract (specifically targeting imToken), photo_scan, memo_scan, disk_scan, and exec. Browser localStorage prevents repeated exploitation of the same device. Mobile security research confirmed that the attackers possess Coruna’s source code: the changes were made through recompilation from source, rather than binary patching. The second was hybridization and splicing. Telemetry shows that some operators deploy both attack chains and even combine techniques from the two into hybrids informally dubbed DarkCoruna or Darkuna. Second-generation variants generally feature stronger jailbreak and virtualization detection, stronger encryption, and enhanced persistence mechanisms. Dedicated Telegram implants have also emerged. Meanwhile, numerous LLM-assisted imitations are circulating, many of them nonfunctional “AI slop.” The criminal market, too, is a mix of capable tools and unusable junk. The third was integration for full version coverage. Analysis of a Chinese-language operator’s production server uncovered a previously undocumented third delivery chain, gooll. Its gooll.html targets only devices running versions below iOS 18. Devices on iOS 18 or later are automatically redirected to /ios18/frame.html, entering the DarkSword branch. The two chains are seamlessly integrated. gooll’s kernel stage deserves particular attention. It abandons per-model offset tables entirely in favor of runtime fingerprinting: reading the XNU kernel build number, scanning drivers for byte signatures, and probing for the presence of IOKit services to select the appropriate exploit path dynamically. It uses five independent memory-access backends, falling back from one to the next in sequence. For PPL bypass, it includes two approaches: page-table forgery and ECC-aware writes. Every kernel write is self-verified through a write–readback–compare sequence. None of the binaries contain CVE identifiers—a hallmark of closed-source commercial toolkits that deliberately conceal the vulnerabilities they exploit. Its XNU version gates also match the version table in DarkSword’s 18.x chain, providing strong evidence that the two chains share a common origin. 2.4 FomoPeek: Bringing a Kernel Exploitation Framework to the App Store Web-based watering holes still require victims to visit the wrong site. The FomoPeek case, exposed in September 2026, showed that attackers can instead enter Apple’s official storefront and wait for victims to come to them. This is the report’s most extensively examined case: the forensic evidence is detailed enough to reveal every component of the attack chain. Packaging and user acquisition. Listed on the App Store as “FomoPeek – Whale Tracker & Smart Alerts,” the app presented itself as a whale-monitoring tool for Solana, Ethereum, and TRON. It explicitly promised “read-only access, no wallet connection, no seed phrase required.” It had a website, an official X account, and a free listing in the Finance category—all the outward signs of a legitimate project. Promotion ran through crypto influencers and communities. Users downloaded and registered with an invitation code, set a security code, and added wallets to monitor. They could earn 5–7 USDT by spending five to seven minutes in the app on a physical device, with “one opportunity per iPhone.” That time requirement was no marketing gimmick. As discussed below, its embedded cicuta_virosa exploit strategy takes more than two minutes per run. The campaign rules fit the technical requirements precisely. Trojanization timeline. The domain was registered on August 28, 2026, and version 1.0 appeared on the App Store on August 29. Version 1.1 (build 105), released on September 9, introduced the malicious modules. Version 1.2 (build 110), released on September 12, retained them. Version 1.3, released on September 17, removed both malicious frameworks entirely, shrinking the IPA from 10.47 MB to 1.81 MB. The malicious modules and the main executable were signed under the same Apple signing identity. The original IPA retained FairPlay encryption metadata, confirming that it was an App Store-distributed build, rather than a re-signed or sideloaded copy. By September 16, victims had already posted public theft warnings on X. Static analysis. The two malicious frameworks had distinct roles: apptrace handled C2 communications, while libapptracecore handled kernel exploitation and data collection. The main executable loaded both at startup through non-weak LC_LOAD_DYLIB commands. Yet all 1,048 imported symbols in its symbol table came from system libraries, with no explicit calls to framework class or method names. Even tracing three call levels from 34 C++ static initialization functions failed to reach the attack code. From a static-analysis perspective, these were two sleeper modules: loaded at launch and waiting for remote activation. Inside libapptracecore was a complete exploit arsenal: eight kernel exploit strategy classes inheriting from a common interface, each with a built-in check for whether the current device was supported. They declared coverage of iOS 12.0–18.7.2 and 26.0–26.1. The model table included devices from 2023–2025, including the iPhone 16 and 17 series. One strategy was explicitly named DarkSwordStrategy, covering the 16.7–18.7.2 and 26.0–26.1 ranges. Strings in the kernel components made their purpose clear:

72/100·B+Short+25

meme10/24meme

Confidentiality on Aptos comes in three layers. All three are live on mainnet, and all three are opt-in. On a public blockchain, a lot is visible by default: balances, transfer amounts, and the details of pending transactions. Each layer gives users a choice over what they share. ‣ Identity: Keyless Accounts Keyless Accounts let people create and manage blockchain accounts with credentials like Google or Apple, without publicly tying that identity to an onchain address. ‣ Amounts: Confidential $APT Confidential APT allows users and institutions to encrypt balances and transfer amounts. Validators verify a transaction is valid while the amounts stay confidential. Addresses remain visible, keeping a clear pathway to accountability and compliant use cases. ‣ Intent: Encrypted Mempool Encrypted Mempool lets users opt in to encrypt a transaction's details until its block is finalized, designed to lower the risk of MEV attacks. Sender and gas fee stay visible. What each layer makes possible: • Keyless Accounts: getting started with a login people already have • Confidential APT: payments where amounts stay between sender and receiver • Encrypted Mempool: institutions can place large orders without signaling intent before execution, traders can encrypt the orders they choose, and AI agents' trade inputs stay encrypted until execution Confidential APT is available in @PetraWallet and on Confidential Assets Web by @AptosLabs. Encrypted Mempool is available via Petra and on @DecibelTrade. • Petra: petra.app • Confidential Assets Web: confidential.aptoslabs.com Retweeted by @AptosLabs from @Aptos

62/100·B+Long

meme10/24meme

@LordOfAlts OMC and two megacap earnings on the same day is wild. Reply to @LordOfAlts: 🚨 THE NEXT 10 DAYS COULD BE VERY VOLATILE FOR CRYPTO. The crypto market is fighting to hold key support. Other asset classes are under pressure, inflation remains high, and oil is trading above $100, yet crypto is still holding up. Now, look at what's coming: • Oct 27: Israel Election • Oct 28: FOMC Meeting • Oct 28: Google and Meta Earnings • Oct 29: Amazon and Apple Earnings • Nov 03: US Midterm Elections Any one of these events could move the market sharply in either direction. Key levels to watch: • Bitcoin: $80,000, then $76,000 • ETH: $2,350 • Altcoin Market Cap: $214 billion Bitcoin has already lost its 50-day moving average. If BTC breaks below $80,000, selling pressure could increase, potentially sending the price toward $76,000. Avoid using high leverage over the next 10 days. A single headline could change market direction in seconds. If you're a spot buyer, start identifying the altcoins you want to accumulate and keep some cash ready. Wait for potential panic-driven opportunities. This doesn't mean you should sell here. It means being prepared to buy more when others are fearful. Bitcoin's broader bull trend remains intact as long as it holds the weekly 50-day moving average, currently near $76,100.(Historical earnings: For 2026Q2 (period ended 2026-03-28), Apple reported basic EPS of 4.87, diluted EPS of 4.85, and net income of USD 71.675 billion. Prior-year 2025Q2 showed basic EPS of 4.06, diluted EPS of 4.05, and net income of USD 61.110 billion. For 2026Q1 (period ended 2025-12-27), basic EPS was 2.85, diluted EPS 2.84, and net income USD 42.097 billion, versus prior-year 2025Q1 basic EPS of 2.41, diluted EPS of 2.4, and net income of USD 36.330 billion. Consensus expectations: For 2026Q4 (event date 2026-11-02), consensus expects EPS of 1.9782 and revenue of USD 113.357 billion.)

25/100·CNeutral+10

meme10/23meme

Today was a big day for financial markets, here are the 8 headlines you need to know ↓ 1. The McRib is coming back soon (iykyk). 2. The Fed purchased $3.653 billion in short term Treasury bills today. 3. Brent crude oil soars above $116/barrel for the first time since May. 4. A tanker carrying 40,000 tons of Russian diesel is reportedly en route to New York ⁠following agreement with President Trump. 5. Apple overtakes Nvidia to become the world’s most valuable company. 6. Amazon has scrapped plans to build data centers in Northern Virginia after widespread opposition from residents. 7. Elon Musk says Tesla will increase the production of Megapacks "as much as possible" due to the extreme demand from data centers. 8. OpenAI is reportedly closing in on a $30 billion funding round at a $1.25 trillion valuation. If you enjoyed this post, you’ll love following @CoinbasePredict. Retweeted by @CoinbaseMarkets from @CoinbasePredict

72/100·B+Long+9

meme10/23meme

BREAKING: $AAPL is now live on Solana via @sunrise, issued by @Backpack Securities. Quoted @sunrise: $AAPL is now listed on @Solana via Sunrise. Issued by @Backpack Securities.

72/100·B+Long