SlowMist's Chief Information Security Officer 23pds stated that the black and gray market has assembled a complete attack chain targeting iOS: users clicking on links may have their private keys and mnemonics stolen. The affected range is defined as iOS 13 to 26.5, and it is recommended to upgrade the system immediately.

The described path stops at the results layer: after Safari opens a webpage, a browser engine memory issue is exploited to gain read/write access to the script layer; then it breaks through pointer authentication and webpage content sandboxing, leading to kernel privilege escalation and reading keychain and wallet data. Public reports link this chain to the previously leaked DarkSword tool, which has seen real-world reuse. After the tool leaked in March, SlowMist reported a phishing page disguised as a free server in early September, targeting unpatched versions 18.4 to 18.6.2, which could collect input while the wallet application was in the foreground. At that time, six vulnerabilities had been patched by Apple, and accessing the page itself does not equate to the mnemonic being lost; evidence must be collected to confirm.

At the same time, FomoPeek versions 1.1 to 1.2 were reported to carry an iOS kernel exploitation framework, automatically selecting routes based on model and system version, affecting approximately 12.0 to 18.7 and 26.0 to 26.1; if successful, it could escape the sandbox and decrypt the keychain. Apple has patched multiple WebKit and kernel issues in versions 26.5.2 and others, but the official designation of these patches has not been marked as "in-the-wild exploitation." 23pds's warning extends to 26.5, indicating that devices not updated to the latest patch number remain exposed.

Commonly mentioned on the wallet side are hot wallets that store keys in the device keychain or allow Safari to open unknown pages. Hardware wallets and offline backups are not directly within the range of this browser chain. SlowMist and the OKX security team have jointly verified some stolen cases and the correlation with malicious application versions but have not released a total loss table based on addresses.

Who is buying, who is selling: buyers are malicious pages that can be opened with one click and expired vulnerability packages, while sellers are the mnemonics in the keychain. The incident is driven by security personnel's warnings, with funds migrating from hot wallet addresses to attacker-controlled addresses, rather than flowing out from the token fundamentals. Beneficiaries are holders who have upgraded and switched to cold storage, while those under pressure are users stuck on 26.5 and below, still using Safari to click on airdrop and "free server" links. The pace of Apple's patches determines the length of the window, while the black market's reuse of n-day vulnerabilities determines whether the window has been priced.

No unified stolen list linked to this warning has been seen on-chain; what can be verified are security company statements, previous DarkSword real-world reports, and higher minor version patches released by Apple.

Source: Public Information