SlowMist: No confirmed crypto thefts linked to recent iPhone Safari exploit
Security firm clarifies scope of iOS vulnerability, urging users to update devices despite lack of evidence of successful wallet compromises.
Quick Look
- Security firm SlowMist reports no confirmed cryptocurrency thefts linked to a recent Safari exploit targeting iPhones.
- While the exploit can access Keychain data, the firm clarifies that the widely reported iOS 13-26.5 range is preliminary and unverified.
AI-generated summary
Why It Matters
The exploit reuses techniques from the previously disclosed DarkSword exploit chain. It targets Apple's Keychain to potentially retrieve sensitive information.
An iPhone Safari attack behind recent security warnings hasn’t yet been linked to a confirmed cryptocurrency theft in SlowMist’s investigation.
Multiple reports surfaced this week urging iPhone users to update their devices immediately and warning that malicious Safari pages could expose crypto private keys and seed phrases, with some citing a range from iOS 13 through iOS 26.5.
SlowMist told Cointelegraph that it has not independently confirmed a victim compromised by the specific Safari attack sample it analyzed, while its strongest technical evidence covers iOS 18.4 through 18.6.2.
The company said the “iOS 13 to 26.5” range should be treated as preliminary. “We therefore prefer to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence,” it said.
The Safari attack reuses techniques from a previously disclosed DarkSword exploit chain and is separate from FomoPeek, another SlowMist investigation involving malicious components embedded in an App Store app.
SlowMist finds DarkSword reuse
Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain that had been used by multiple threat actors since at least November 2025.
SlowMist said MistEye, a threat intelligence team led by its chief information security officer, 23pds, first identified the relevant activity in early May.
SlowMist published its analysis of the WYINCC Safari campaign on Sept. 4, identifying a malicious webpage advertising a free virtual private server service.
SlowMist said the page loaded the exploit code when opened on an iPhone using Safari, without necessarily requiring another click from the user.
The vulnerabilities used in the chain had already been disclosed and patched by Apple, SlowMist said.
What the Safari attack was designed to access
SlowMist found that the malicious Safari sample it analyzed included a component designed to access Apple’s Keychain and retrieve and decrypt information stored there. The code could also access app files and shared app data, potentially exposing information stored by crypto wallet applications.
“The sample demonstrates the collection capability and the intended targets; it does not by itself prove successful extraction from every targeted wallet,” SlowMist said.
“We did not execute the full chain on a real victim device, so we cannot identify a specific victim whose device we independently confirmed was successfully compromised by this exact sample,” SlowMist added.
SlowMist still recommends updating iOS
Despite the limits of the available evidence, SlowMist advised iPhone users to install the latest iOS security updates available for their devices and avoid suspicious links.
For users who cannot update immediately or face elevated risks, SlowMist recommended considering Apple’s Lockdown Mode as an additional defense, while cautioning that it has not confirmed the feature completely blocks this specific Safari attack.
SlowMist also urged users who believe a wallet key or seed phrase may have been exposed to move their assets to a newly generated wallet on a clean device rather than continue using potentially compromised credentials.
Open Questions
- Are there any verified victims of this specific Safari exploit?
- Does Lockdown Mode effectively mitigate this specific attack chain?
