Comment by rhodey_orbits

thanks! I didn't take the time to setup Mist but my understanding is that Mist is especially vulnerable because it's bundled with a wallet and used for browsing DAPPS which always require the JSON API to be enabled.