SlowMist: Safari iPhone exploit hunted wallets, but victims still MIA 🕵️

Blockchain security firm SlowMist has not confirmed any cryptocurrency theft linked to a malicious Safari webpage targeting iPhones, even as technical evidence indicates the exploit chain was designed to extract wallet secrets. The company told Cointelegraph that it has not independently verified a victim compromised by the specific Safari attack sample it analyzed, while its strongest technical evidence covers iOS 18.4 through 18.6.2. Reports circulating this week warned of risks spanning iOS 13 through iOS 26.5, a range SlowMist described as preliminary. "We therefore prefer to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence," the firm said.

SlowMist's MistEye threat intelligence team, led by chief information security officer 23pds, first identified the relevant activity in early May. The campaign, dubbed WYINCC, was detailed publicly on Sept. 4 and centers on a malicious webpage advertising a free virtual private server service. When opened in Safari on an iPhone, the page loaded exploit code without necessarily requiring additional user interaction. SlowMist said the vulnerabilities in the chain had already been disclosed and patched by Apple, and the techniques reused components from an iOS exploit chain called DarkSword that Google Threat Intelligence Group disclosed in March, noting it had been used by multiple threat actors since at least November 2025.

Analysis of the sample showed a component built to access Apple's Keychain and retrieve and decrypt stored credentials, as well as to read app files and shared app data — potentially exposing information held by crypto wallet applications. "The sample demonstrates the collection capability and the intended targets; it does not by itself prove successful extraction from every targeted wallet," SlowMist said. The firm added, "We did not execute the full chain on a real victim device, so we cannot identify a specific victim whose device we independently confirmed was successfully compromised by this exact sample." SlowMist also stressed that the Safari investigation is separate from its FomoPeek probe, which involves malicious components embedded in an App Store app.

Despite the evidentiary limits, SlowMist recommended that iPhone users install the latest iOS security updates available for their devices and avoid suspicious links. The firm also suggested Apple's Lockdown Mode as an additional defense for users unable to update immediately or facing elevated risk, while noting that Lockdown Mode's effectiveness against this specific chain has not been confirmed.