SlowMist: Hackers Implement Full-Chain iOS Exploit to Steal Private Keys and Mnemonic Phrases Across Versions 13 to 26.5 SlowMist Chief Information Security Officer 23pds has issued an urgent security warning advising all iOS users to update their devices immediately. He disclosed that cybercriminals have actively operationalized a full-chain exploit framework capable of silently exfiltrating private keys and mnemonic seed phrases directly from iOS devices. The attack execution pathway involves: luring targets to a malicious webpage via Safari through social engineering or watering-hole tactics, triggering memory corruption in WebKit/JavaScriptCore (JSC) to secure arbitrary read/write access at the JavaScript layer, subsequently bypassing Pointer Authentication Codes (PAC) to achieve native code execution, escaping the WebContent sandbox, and completing kernel privilege escalation to root to drain device Keychains and local crypto wallet application data. The potentially affected versions are reported to span iOS 13 through iOS 26.5 (pending final confirmation).

🚨 SlowMist TI Alert: FomoPeek App v1.1–1.2 Asset Theft 🚨 We have recently received multiple reports of users having assets stolen. Our investigation found that the affected cases involved private key exposure, and some of the users had previously installed and used @FomoPeek App versions 1.1–1.2. A joint investigation by the @SlowMist_Team and @okx security teams confirmed that the app contains malicious code.⚠️ Besides its normal features, FomoPeek includes two modules that are unrelated to its stated business functions. One of them contains an #iOS# kernel exploitation framework with eight different exploit methods. The framework can automatically choose an attack method based on the device model and iOS version. ‼️Affected iOS versions: iOS 12.0–18.7 and iOS 26.0–26.1.‼️ If the exploit succeeds, the app may escape the iOS sandbox, access and decrypt Keychain data, and read files belonging to other apps on the device. 🔐 This means sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, and files, may be exposed. The app also connects to hidden servers that are unrelated to its public-facing services and can receive remote commands. Based on plaintext traffic captured during our analysis, the attack functionality is currently enabled and runs automatically at regular intervals. In general, devices running older iOS versions are at higher risk. If you have installed or used FomoPeek versions 1.1–1.2, we recommend that you take action immediately: 1️⃣ Check your accounts and assets for any unusual activity. 2️⃣ On a trusted device where FomoPeek has never been installed, create a new account and generate a new private key and seed phrase. 3️⃣ Move your assets to the new account as soon as possible. 4️⃣ Update your device to the latest available iOS version. 5️⃣ Do not continue using or reinstalling FomoPeek. 6️⃣ If you notice any suspicious asset activity, contact the official support team of the relevant platform and keep the affected device and related evidence for further investigation.

🚨 SlowMist TI Alert: KREMLIN Malware 🚨 Recently, a Brazilian banking malware operation, #REF9334#, active since at least May 2025, was disclosed. 🔴 The #KREMLIN# malware ecosystem uses multi-stage loaders and malicious browser extensions to steal credentials, session tokens, and sensitive data. ⚠️ Its malicious extensions can be installed in #Chrome# and #Edge# without user approval by bypassing Chromium integrity mechanisms, including Secure Preferences, HMACs, and App-Bound encrypted hashes. ⛓️ The operation also uses #Ethereum# smart contracts as dead-drop resolvers to dynamically update C2 endpoints and payload hosting locations, making the infrastructure harder to disrupt. ⚙️ After registering a network canary (kill switch) domain, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. 🛡️ Security teams should monitor for related malware, browser-extension activity, and infrastructure associated with the campaign. 🔑 Admin: - 0x5C32A09873be70a92fd8bB5A9fED7967dE06BdE6 📜 Smart Contracts: - 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 - 0x64Def0A6099c4DE9C413B108EAae85A3C7457615 - 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b (currently active) 🔎 IOCs: 📌 Source:

🚨 SlowMist TI Alert: CVE-2026-85706 🚨 🔴 A critical path traversal vulnerability in @gitlab CE/EE (CVSS 10.0) could allow unauthenticated attackers to read arbitrary files from affected GitLab servers via the Repository Commits API. 🛠️ GitLab has released security patches to address this vulnerability. ⚠️ Affected: affected from 18.7 before 19.1.8 affected from 19.2 before 19.2.6 affected from 19.3 before 19.3.2 🚨 Self-managed GitLab users should upgrade to 19.1.8, 19.2.6, or 19.3.2 immediately, and review logs and potentially exposed credentials after patching. 🔐 Stay alert and keep your infrastructure up to date. 🔗

🚀MistTrack & SlowMist KYT Partner Program is officially launched! As stablecoin payments and digital asset businesses continue to grow, on-chain #AML#, #KYT#, and risk analysis are becoming increasingly important for organizations worldwide. 🌍 SlowMist is now looking for global partners with expertise and resources across #Web3#, finance, payments, compliance, security, and local markets. Partner Benefits: 🔹 Exclusive customer discount codes 🔹 10% commission on @MistTrack_io subscriptions, based on the customer’s actual payment amount 🔹 20% commission on the contract value of SlowMist KYT institutional projects 🔹 Commission period of up to 3 years 🔹 Free trials, product materials, and technical support 🔹 Automatic order & commission tracking 🔹 Flexible settlement options Two products, different needs: Standardized, scalable promotion → MistTrack Institutional, customized projects → SlowMist KYT 📌 Apply now: 🔎 Learn more: We welcome partners who understand local markets and customer needs to join us in bringing proven on-chain AML, KYT, and risk analysis capabilities to more customers worldwide.🙌 Read more:

🚨 SlowMist TI Alert 🚨 A coordinated Rust supply chain attack affecting the legitimate crates `arrayref@0.3.10`, `internment@0.8.7`, and `append-only-vec@0.1.9`. The compromised releases introduced the malicious `proc-macro1` dependency, which automatically downloads and executes cross-platform malware during Cargo builds. arrayref is deeply embedded in the Rust ecosystem. Its previous clean release, v0.3.9, accumulated roughly 152 million downloads, while the crate also appears transitively in dependency chains involving widely used Rust GUI stacks. It also has a significant footprint across the Solana ecosystem, including Solana token, staking, and validator-related components. These usage figures do not indicate that those projects or hosts were compromised. Potential attacker actions include build-time remote code execution, host profiling, persistence, browser-related data collection, and execution of additional scripts or shell commands. Users should inspect Cargo.lock files and build environments for affected versions. Importantly, arrayref = "0.3.9" does not strictly pin v0.3.9 and may resolve to v0.3.10 during fresh dependency resolution or updates. Where appropriate, use an exact requirement such as arrayref = "=0.3.9" and verify the resolved version in Cargo.lock. Rotate potentially exposed credentials and rebuild affected systems from trusted environments. You can also visit to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant!

🚨 SlowMist TI Alert 🚨 MistEye has detected a large-scale npm supply chain compromise impacting the Keyv/Cacheable ecosystem. Attackers published over 2,000 malicious package versions across the affected ecosystem, including keyv@6.0.0. Keyv, a widely used key-value storage abstraction with adapters for Redis, SQLite, PostgreSQL, MongoDB, and other backends, has roughly 127 million weekly downloads, leading to significant downstream supply chain exposure. The attackers' tradecraft closely mirrors techniques previously observed in the Shai-Hulud npm worm campaign, pointing to a highly automated and scalable supply chain attack. Potential attacker actions include credential theft, environment variable exfiltration, CI/CD secret compromise, remote payload delivery, and lateral propagation through compromised development environments. Security teams should immediately identify and remove affected package versions, upgrade to verified safe releases, review dependency lockfiles and build logs, monitor for suspicious outbound connections, rotate exposed credentials, and rebuild impacted environments from trusted sources if compromise is suspected. You can also visit to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant!

🚀 SlowMist Hacking Time | Exploring High-Quality AI Agent Design Today, SlowMist held an internal Hacking Time session, with Mr. A sharing his thoughts on “High-Quality AI Agent Design” and how to build more reliable AI Agent systems. The session explored how to move beyond long prompts and design AI Agents with structured workflows, clear execution processes, and verifiable outcomes — making Agent behavior more transparent and easier to validate. As AI Agents move closer to real-world adoption, reliability and security will become essential foundations for their future development. SlowMist will continue exploring AI Agent technologies and security challenges, contributing to a safer and more reliable AI ecosystem.🫡

🚀 SlowMist has officially released MistEye DNS Guard, a lightweight local DNS relay and threat observation tool built with Rust for macOS and Linux. By turning DNS into an observation point, MistEye DNS Guard helps detect malicious domains, public IPs, and outbound process connections — while keeping normal DNS resolution unaffected through asynchronous threat detection. 🌟 Key capabilities: 🔹DNS relay & system DNS takeover 🔹Domain and public IP threat detection 🔹Outbound process monitoring 🔹Malicious event retention & Webhook alerts 🔹Lightweight deployment with built-in SQLite persistence, no external database required ⚡ No complex infrastructure required — download the precompiled binary, configure the TOML file, and start monitoring. 📄 Learn more about MistEye DNS Guard: 🛠️ Explore the open-source project:

🚨 SlowMist TI Alert 🚨 💸 @VerusCoin Loss: ~$7.5M ⚠️ Unlike the prior 0x6990…b321 exploit, which decoupled the validated proof from the executed transfer payload, this attack hash-bound the transfers to the CCE but failed to validate the CCE’s economic backing; both exploit flawed cross-chain import validation. 🔍 Root Cause: `VerusProof.checkExportAndTransfers` verified selected CCE fields—including `hashReserveTransfers` against attacker-supplied serialized transfers and the source/destination IDs—but did not enforce the CCE’s accounting semantics. It failed to parse or validate `totalamounts`, `totalfees`, `totalburned`, CTxOut `nValue`, or whether the prior CCE outpoint carried sufficient value and assets to cover the claimed transfers. As a result, a matching transfer hash was incorrectly treated as authorization to release bridge assets, rather than merely a commitment to the requested transfers. 📌 Attacker EOA: 0xbda71b58cec0b1c20a8f87ccd52fa0679747855c 📌 Victim Bridge: 0x71518580f36feceffe0721f06ba4703218cd7f63 📌 Vulnerable Contract: 0x54e03a1682fd0bb065b669f6296f97028dcfd4ce 📌 Fund Receiver: 0xcfd0a20703cd11e0b9f665e1c3f1ef989c142d54 Impact: The attacker submitted a successor CCE anchored to an accepted Verus state root, containing a hash commitment to eight attacker-defined reserve transfers. Because the bridge did not verify whether the CCE’s economic fields backed those transfers, it executed eight payouts from bridge custody to the attacker-controlled receiver—releasing ETH, DAI, USDC, USDT, and four additional tokens without enforced cross-chain asset backing. Powered by Tx: