SlowMist: No Confirmed Link Between iPhone Safari Attacks and Crypto Theft

Blockchain security firm SlowMist stated that its investigation has not yet linked recent iPhone Safari security warnings to confirmed cases of cryptocurrency theft. The firm has not independently verified victims resulting from the specific Safari exploit samples analyzed, which cover iOS versions 18.4 through 18.6.2. SlowMist noted that the Safari exploit reuses techniques from the previously disclosed DarkSword exploit chain and is independent of the FomoPeek investigation involving malicious components in App Store apps. Google's Threat Analysis Group (TAG) previously identified DarkSword in March as an exploit chain used by multiple threat actors since November 2025.