Black and gray market actors have developed an attack chain targeting iOS users through malicious links, with the potential to steal private keys and mnemonic phrases. SlowMist Chief Information Security Officer 23pds said the campaign uses Safari browser exploits and WebKit memory corruption to compromise the JavaScript layer, gain native call capabilities, bypass security protections, escape sandboxes and obtain kernel-level root access. That access can be used to exfiltrate Keychain and wallet data. The vulnerability affects iOS versions 13 through 26.5, and users are advised to upgrade their devices immediately to reduce the risk of credential theft and unauthorized wallet access.