SlowMist flags limits of evidence in iPhone Safari crypto attack probe

Traders Union
All News
Crypto
SlowMist: iPhone crypto attack probe

Highlights

SlowMist's investigation found no independently confirmed victim devices compromised by the WYINCC Safari crypto attack sample, despite public warnings of exposure risk.
The Safari exploit chain reused techniques from the DarkSword campaign patched by Apple, and claims of iOS versions 13 to 26.5 being vulnerable remain unproven pending technical evidence.
The sample demonstrated capability to access Apple's Keychain and crypto wallet files, but SlowMist advises caution as full extraction from wallets was not verified in real-world cases.

Technical findings and evidence scope

As reported by Cointelegraph, SlowMist says its investigation has not independently identified a victim whose device was confirmed compromised by the exact Safari attack sample analyzed, despite public warnings that the campaign could expose private keys and seed phrases stored on iPhones.

The company says the malicious webpage in the WYINCC Safari campaign advertised a free virtual private server service and loaded exploit code when opened in Safari on an iPhone, without necessarily requiring another user click. SlowMist adds that the exploit chain reuses techniques from the previously disclosed DarkSword campaign and is separate from FomoPeek, another probe involving malicious components embedded in an App Store app.

Google Threat Intelligence Group disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since at least November 2025. SlowMist says its MistEye threat intelligence team, led by chief information security officer 23pds, first identified the relevant activity in early May and published its analysis on Sept. 4.

According to SlowMist, the vulnerabilities in the chain had already been disclosed and patched by Apple. The firm also says the wider claim that iOS versions from 13 to 26.5 are affected should be treated cautiously until reproducible technical evidence is available.

Wallet exposure risks and user response

SlowMist says the Safari sample it reviewed included a component designed to access Apple's Keychain and retrieve and decrypt information stored there. The code could also access app files and shared app data, potentially exposing information held by crypto wallet applications.

The company says the sample demonstrates collection capability and intended targets, but does not by itself prove successful extraction from every wallet targeted. It adds that because it did not execute the full chain on a real victim device, it cannot identify a specific victim independently confirmed as compromised by this exact sample.

Even with those evidentiary limits, SlowMist recommends that iPhone users install the latest iOS security updates and avoid suspicious links. For users unable to update immediately or facing higher risks, it says Apple's Lockdown Mode may offer an additional defense, though it has not confirmed that the feature fully blocks this specific Safari attack.

SlowMist also advises users who believe a wallet key or seed phrase may have been exposed to move assets to a newly generated wallet on a clean device, rather than continue using credentials that may already be compromised.

In our earlier coverage of regulators’ push to address AI-related financial risks, we explained how supervisors in multiple countries are looking to use existing powers and build their own tools to monitor cyber threats and operational vulnerabilities. We also noted a shift away from purely demanding model explainability toward outcome-based oversight, legal accountability, and practical guardrails designed to limit real-world damage.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.