SlowMist says iPhone Safari attack is not yet linked to confirmed crypto theft

SlowMist says it has not confirmed any cryptocurrency theft tied to a recent Safaribased attack affecting iPhone users. The security firm told Cointelegraph that its analysis has only reproduced evidence against devices running iOS 18.4 through 18.6.2, while claims that the issue affects iOS 13 through iOS 26.5 remain unverified. The malicious page was reportedly used in a WYINCC campaign that loaded exploit code when opened in Safari and reused techniques from the previously disclosed DarkSword exploit chain. SlowMist said the sample was designed to access Apple’s Keychain and could also reach app files and shared data, which may put crypto wallet information at risk. However, the company emphasized that its analysis did not include a real victim device and does not prove that the sample successfully stole funds or seed phrases from every targeted wallet. SlowMist advised users to install the latest iOS security updates, avoid suspicious links, and consider Apple’s Lockdown Mode if they cannot update right away.