Critical iOS Exploit Threatens Crypto Wallet Security

Fxdailyreport

Critical iOS Exploit Threatens Crypto Wallet Security

First seen 19 Sep 2026, 21:21 UTC • •63.0

Article Content

1 / 11

Browse articles

ThreatCluster •September 20, 2026 at 21:02 UTC

•iOS versions 13 to 26.5 are vulnerable to a new exploit targeting crypto wallets.
•Attackers can steal private keys and mnemonic phrases via social engineering and browser vulnerabilities.
•Immediate device updates are recommended to protect against potential data theft.

SlowMist has issued a warning regarding a sophisticated exploit targeting iOS devices, affecting versions 13 to 26.5. The exploit allows attackers to steal private keys and mnemonic phrases through a chain of vulnerabilities, primarily using social engineering tactics to direct users to malicious web pages. Once a victim interacts with these pages in Safari, attackers can leverage memory corruption vulnerabilities in WebKit and JavaScriptCore to gain elevated privileges, ultimately accessing sensitive wallet information stored in the device's Keychain. Users are urged to update their devices immediately to mitigate the risk. The attack highlights a growing trend of browser-based threats in the cryptocurrency space. Currently, there are no confirmed reports of active exploitation in the wild, but the potential for such attacks remains high. As the crypto market continues to evolve, users should remain vigilant against these emerging threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 49d ago How this analysis works

Timeline

2026-09-19

SlowMist issues warning about iOS exploit

SlowMist alerts users of a critical exploit affecting iOS versions 13 to 26.5 that can steal private keys.

2026-09-19

Urgent updates recommended

Users are advised to update their devices immediately to prevent theft of sensitive information.

2026-09-20

Further details on exploit confirmed

SlowMist reiterates the exploit's capabilities and urges caution among iOS users managing crypto assets.

More articles in this cluster (10)

Threat Graph

12 entities, 23 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Malware
Phishing
T1068 - Exploitation for Privilege Escalation
T1203 - Exploitation for Client Execution
T1566.002 - Spearphishing Link

Weakness (2)

CWE-120 - Classic Buffer Overflow
CWE-269 - Improper Privilege Management

Affected Platform (5)

IOS
JavaScriptCore
Keychain
Safari
WebKit

Relationships

Malware targets IOS
Malware targets JavaScriptCore
Malware targets Keychain
Malware targets Safari
Phishing targets IOS
Phishing targets JavaScriptCore
Phishing targets Keychain
Phishing targets Safari
T1068 - Exploitation for Privilege Escalation targets IOS
T1068 - Exploitation for Privilege Escalation targets JavaScriptCore
T1068 - Exploitation for Privilege Escalation targets Keychain
T1068 - Exploitation for Privilege Escalation targets Safari
T1203 - Exploitation for Client Execution targets IOS
T1203 - Exploitation for Client Execution targets JavaScriptCore
T1203 - Exploitation for Client Execution targets Keychain
T1203 - Exploitation for Client Execution targets Safari
T1566.002 - Spearphishing Link targets IOS
T1566.002 - Spearphishing Link targets JavaScriptCore
T1566.002 - Spearphishing Link targets Keychain
T1566.002 - Spearphishing Link targets Safari
Malware related to CWE-120 - Classic Buffer Overflow
Malware related to CWE-269 - Improper Privilege Management
Malware related to WebKit

Continue Reading

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…

GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…