SlowMist: It has not yet been confirmed that the iPhone Safari attack led to stolen crypto assets, and whether iOS 26.5 is affected remains to be verified.
According to TechFlow, on September 25, as reported by Cointelegraph, SlowMist stated that it has not yet independently confirmed whether its analyzed Safari attack samples have resulted in actual crypto asset theft. Current technical evidence primarily covers iOS 18.4 through 18.6.2, and prior claims that "all versions from iOS 13 to iOS 26.5 are affected" remain preliminary assessments.
SlowMist's analysis revealed that the malicious Safari page can exploit a chain of vulnerabilities already patched by Apple to attempt access to Apple Keychain, app files, and shared data, potentially involving information stored in cryptocurrency wallets. However, the fact that the related code has the capability to steal does not mean that data has been successfully extracted from all targeted wallets.
SlowMist continues to advise iPhone users to promptly install the latest iOS security updates and avoid opening suspicious links.
