SlowMist Security Officer Warns of Complete Attack Chain Targeting iOS by Black and Gray Market, Users Clicking Links May Have Private Keys and Mnemonics Stolen
SlowMist's Chief Information Security Officer 23pds stated that the black and gray market has assembled a complete attack chain targeting iOS: users clicking on links may have their private keys and mnemonics stolen. The affected range is defined as iOS 13 to 26.5, and it is recommended to upgrade the system immediately.
The described path stops at the results layer: after Safari opens a webpage, a browser engine memory issue is exploited to gain read/write access to the script layer; then it breaks through pointer authentication and webpage content sandboxing, leading to kernel privilege escalation and reading keychain and wallet data. Public reports link this chain to the previously leaked DarkSword tool, which has seen real-world reuse. After the tool leaked in March, SlowMist reported a phishing page disguised as a free server in early September, targeting unpatched versions 18.4 to 18.6.2, which could collect input while the wallet application was in the foreground. At that time, six vulnerabilities had been patched by Apple, and accessing the page itself does not equate to the mnemonic being lost; evidence must be collected to confirm.
At the same time, FomoPeek versions 1.1 to 1.2 were reported to carry an iOS kernel exploitation framework, automatically selecting routes based on model and system version, affecting approximately 12.0 to 18.7 and 26.0 to 26.1; if successful, it could escape the sandbox and decrypt the keychain. Apple has patched multiple WebKit and kernel issues in versions 26.5.2 and others, but the official designation of these patches has not been marked as "in-the-wild exploitation." 23pds's warning extends to 26.5, indicating that devices not updated to the latest patch number remain exposed.
Commonly mentioned on the wallet side are hot wallets that store keys in the device keychain or allow Safari to open unknown pages. Hardware wallets and offline backups are not directly within the range of this browser chain. SlowMist and the OKX security team have jointly verified some stolen cases and the correlation with malicious application versions but have not released a total loss table based on addresses.
Who is buying, who is selling: buyers are malicious pages that can be opened with one click and expired vulnerability packages, while sellers are the mnemonics in the keychain. The incident is driven by security personnel's warnings, with funds migrating from hot wallet addresses to attacker-controlled addresses, rather than flowing out from the token fundamentals. Beneficiaries are holders who have upgraded and switched to cold storage, while those under pressure are users stuck on 26.5 and below, still using Safari to click on airdrop and "free server" links. The pace of Apple's patches determines the length of the window, while the black market's reuse of n-day vulnerabilities determines whether the window has been priced.
No unified stolen list linked to this warning has been seen on-chain; what can be verified are security company statements, previous DarkSword real-world reports, and higher minor version patches released by Apple.
Source: Public Information
ABAB AI Insight
The battlefield for crypto security companies has long shifted from contract reentrancy to mobile browsers. SlowMist identifies Safari as the first line of defense for hot wallets: if keys enter the keychain, once the web process gains root privileges, application-layer cryptography becomes irrelevant. The leak and subsequent reuse of DarkSword indicate that the layered market for zero-day vulnerabilities sold to state actors and n-day vulnerabilities sold to the gray market is still operational.
The capital path is: phishing page costs are nearly zero, while the returns are entire mnemonic packages. Attackers do not need to crack elliptic curves; they only need users to remain on unpatched system versions. Applications like FomoPeek embed exploitation frameworks into seemingly normal clients, representing another distribution method: app store reviews focus on functionality, not hidden kernel modules. Security companies and exchanges collaborate on evidence collection to separate "clicked links" from "keys have been compromised," avoiding panic-driven false reports that could cause secondary harm.
Comparisons can be drawn to Android clipboard trojans and early Google Chrome vulnerability chains, as well as supply chain incidents targeting hardware wallet firmware. iOS has long been considered a safer hot wallet container than Android, but this warning shifts the assumption: the security boundary lies in the patch number, not in the system brand. The industry phase has transitioned from "do not sign malicious authorizations" to "do not let browsers access the keychain."
Structural judgments belong to technical substitutions. The mechanism is: hot wallets leave private keys in general operating systems, which treat web engines as high-risk surfaces; the gray market fuses these two surfaces into a single chain, increasing the cost of self-hosting on mobile from "remembering mnemonics" to "must run on the latest patch and minimize browser exposure." Hardware isolation and exchange custody thus regain a premium, not because they are more decentralized, but because they do not place root privileges and mnemonics in the same chip's user session.
ABAB News · Cognitive Laws
The door of hot wallets opens in the browser
Without patches, zero-days become n-day commodities
Sandboxing only protects against ordinary applications, not against expired kernel windows