SlowMist said recent iPhone Safari attack samples have not been linked to confirmed cryptocurrency theft or independently verified wallet-data extraction. The strongest technical evidence covers iOS 18.4 through 18.6.2, while reports citing a broader iOS 13 to 26.5 range remain preliminary and the impact on iOS 26.5 is unverified. The campaign, known as WYINCC, reused techniques from the DarkSword exploit chain and used malicious webpages that could load attack code, potentially without another user click. The sample could access Apple Keychain, decrypt stored information, and reach application files and shared data that might contain wallet information, but SlowMist has not confirmed that attackers successfully extracted specific wallet data. The company recommended installing the latest available iOS security updates and avoiding suspicious links, while higher-risk users may consider Lockdown Mode.