An iPhone Safari attack on the back of recent security warnings has yet to be linked to the cryptocurrency theft confirmed in SlowMist’s investigation.
Multiple reports emerged this week urging iPhone users to update their devices immediately and warning that malicious Safari pages could reveal crypto private keys and seed phrases, some citing a range from iOS 13 to iOS 26.5.
SlowMist told Cointelegraph that it has not independently confirmed victims compromised by the specific Safari attack samples it analyzed, while its strong technical evidence covers iOS 18.4 to 18.6.2.
The company says that the “iOS 13 to 26.5” range should be considered early. “We therefore assume that iOS 26.5 is affected until reproducible technical evidence is available,” it said.
The Safari attack reuses techniques from the previously disclosed Darksword exploit chain and is separate from FomoPeek, another SlowMist investigation involving malicious material embedded in an App Store app.
SlowMist Darksword finds reuse
The Google Threat Intelligence Group (GTIG) released DarkSword in March, description This is as an iOS exploit chain that has been used by multiple threat actors since at least November 2025.
SloMist said MistEye, a threat intelligence team led by its chief information security officer, 23pds, first detected the relevant activity in early May.
SlowMist published analysis of the WYINCC Safari campaign on September 4, identifying a malicious webpage advertising a free virtual private server service.
SlowMist said the page loads the exploit code when opened on an iPhone using Safari, without requiring another click from the user.
Vulnerabilities used in the chain have already been disclosed and patched by Apple, Slomist said.
The Safari attack was designed to access the key
SlowMist found that the malicious Safari sample it analyzed included a component designed to access Apple’s Keychain and retrieve and decrypt information stored there. The code can also access app files and shared app data, potentially exposing information stored by crypto wallet applications.
“Sampling demonstrates collection capabilities and intended targets; it does not by itself prove successful extraction from every targeted wallet,” Slomist said.
Related: EU watchdogs warn quantum computers could pick crypto locks
“We did not execute the entire chain on an actual victim device, so we cannot identify a specific victim whose device we independently confirmed was successfully compromised by this exact sample,” Slomist added.
SlowMist still recommends updating iOS
Despite the limited evidence available, SlowMist advised iPhone users to install the latest iOS security updates available for their devices and avoid suspicious links.
For users who can’t update immediately or face a higher risk, Slomist recommends considering Apple’s Lockdown Mode as an additional defense, warning that it hasn’t confirmed that the feature completely blocks this particular Safari attack.
SlowMist also urged users who believe a wallet key or seed phrase has been exposed to move their assets to a newly created wallet on a clean device instead of continuing to use potentially compromised credentials.
magazine: Asia Dominates Crypto Adoption Index, Bitgate’s $352M Hack: Asia Express
