Slow Fog warned that a black-market attack chain targeting iOS users can steal private keys, mnemonic phrases, Keychain data and wallet information, describing a Safari-based compromise path that can escalate to root access and advising users on affected iOS versions to upgrade as soon as possible.

According to Slow Fog, the attack chain begins when a user opens a webpage in Safari. The firm said the chain can abuse memory corruption in WebKit and JavaScriptCore to achieve JavaScript-level read and write access, bypass pointer authentication, obtain native call capability, escape the WebContent sandbox, and then escalate privileges at the kernel level.

Slow Fog said that process can ultimately give attackers access to Keychain data and wallet-related information stored on the device, including private keys and mnemonic phrases. The warning framed the issue as a black- and gray-market attack chain rather than a single isolated phishing page or wallet-specific exploit.

The report said affected versions span iOS 13 to 26.5, but additional official technical confirmation on that version range was not included in the available disclosure. No CVE identifiers, Apple advisory references, or public patch details were provided in the warning. Slow Fog’s immediate recommendation was for users to update their systems as quickly as possible.

The broader context is that iOS-targeted crypto theft has increasingly focused on browser-based delivery, social engineering, and sideloading-related abuse rather than direct attacks on a single wallet product. Earlier security warnings tied to older iPhone users also described Safari-driven compromise paths that could expose wallet secrets once a victim interacted with malicious content.

Why It Matters

This warning matters because it shifts crypto security attention back to the mobile device itself. If an attacker can move from a Safari session to system-level access, hardware and app-level wallet protections may be less effective once the operating environment is compromised.

It also underlines a broader market-structure issue for exchanges, wallets, and custodial service providers: a large share of retail crypto activity now depends on smartphones. Security incidents that target iPhone browsing, credential storage, and on-device wallet use can affect account safety, user trust, and support operations even when the underlying blockchain or wallet protocol is not at fault.