FomoPeek crypto stealer: malicious code found in iOS app for stealing seed phrases

Researchers from SlowMist have discovered malicious code in the FomoPeek iOS app that intercepts seed phrases from cryptocurrency wallets. In confirmed cases, private keys were leaked from users who installed versions 1.1 and 1.2 of the app. iOS devices running firmware versions 12.0-18.7 and 26.0-26.1 are at risk. Two third-party modules were found in these versions, including the DarkSword frameworks for iOS kernel exploitation, with eight attack methods that can be automatically selected. If the injection is successful, the app could access Keychain data and read files from other applications. SlowMist also reported a connection between the app and hidden servers that could send remote commands. The attacking functionality is already activated and runs automatically. FomoPeek users are advised to check their accounts for suspicious activity, create a new account with a new seed phrase and private key, and transfer their assets. It is recommended to update iOS to the latest version, not to reinstall the app, and to contact official support if signs of compromise are detected.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.