SlowMist: Unconfirmed iPhone Safari Attack Leads to Theft of Crypto Assets

Blockchain security company SlowMist has stated that the attack samples analyzed against iPhone Safari have not been linked to any confirmed incidents of crypto asset theft. The existing technical evidence primarily covers iOS versions 18.4 to 18.6.2, and there is still a lack of reproducible technical evidence regarding whether iOS 26.5 is affected. The attack reused previously disclosed DarkSword attack chain techniques, loading code through malicious web pages disguised as free virtual private server services. The samples include components that access Apple Keychain, extract and decrypt stored information, and can also access application files and shared data. SlowMist recommends that iPhone users install the latest iOS security updates suitable for their devices and avoid clicking on suspicious links. Users who suspect that their wallet private keys or mnemonic phrases have been compromised should generate a new wallet on a clean device and transfer their assets.