SlowMist has discovered malware in the FomoPeek iOS app that steals cryptocurrency by intercepting seed phrases and private keys.
SlowMist researchers have identified malware in the iOS version of the FomoPeek app that has been linked to multiple asset thefts from cryptocurrency users. The app’s malicious code is able to capture seed phrases from users' wallets, rendering their funds vulnerable.
Victims primarily used FomoPeek versions 1.1 and 1.2, which have been flagged for containing unauthorized modules that do not align with the app's intended functionality. These modules leverage DarkSword frameworks to exploit vulnerabilities in the iOS kernel, utilizing various attack strategies tailored to the specific device model and operating system version.
The malware's functionality enables it to bypass the iOS sandbox, access Keychain data, and potentially read files from other applications, posing a severe security threat.
Devices running iOS versions 12.0-18.7 and 26.0-26.1 are particularly at risk as they contain these vulnerabilities. Furthermore, the app communicates with undisclosed servers, allowing it to execute remote commands.
SlowMist has warned that the malware operates automatically and is already active on infected devices. Users of the FomoPeek app are urged to watch for unusual account activity and to create new accounts with fresh seed phrases and private keys on secure devices. It’s also advised to update to the latest iOS version and refrain from reinstalling the app.
Users should contact official support if they suspect their accounts may have been compromised, while retaining devices for further analysis. This incident comes in the wake of an earlier phishing attack in April, which resulted in a loss of $9.5 million from users through a fake Ledger app in the App Store.
