The exploit chain is identified as Coruna or DarkSword and is currently active in the wild. To prevent remote code execution and data theft, users are urged to install pending iOS updates and avoid suspicious links in the Safari browser. The full range of affected iOS versions has not been independently confirmed.
Tuesday, October 20, 2026
Story
iPhone Safari Exploit Steals Crypto Keys From iOS 13 to 26.5
Cybersecurity28 days ago
Attackers are leveraging a zero-day vulnerability in Apple Safari to extract cryptocurrency private keys and seed phrases from iPhones. The exploit targets a WebKit and JavaScriptCore memory-corruption flaw to bypass security protections, escape the browser sandbox, and gain high-level system privileges for access to the device Keychain. The impact reportedly spans iOS 13 through iOS 26.5, though the attack requires victims to open a malicious webpage to target local wallet applications.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.