Key Insights:
- A new piece of iOS malware known as FomoPeek has emerged, specifically targeting cryptocurrency holders.
- Binance and various security professionals have issued warnings regarding this security flaw.
- The malicious software enables attackers to pilfer iPhone users’ funds by gaining entry to every application file stored on the device.
Blockchain security organization SlowMist uncovered malicious software within the iOS application FomoPeek, which specifically aims at cryptocurrency holders. The company issued a warning to iPhone owners on September 19, pointing out that multiple individuals had reported thefts of their digital assets.
SlowMist reported that its analysis revealed victims suffered exposed private keys, noting that several impacted individuals had downloaded FomoPeek versions 1.1 or 1.2.
FomoPeek markets itself as a read-only tool designed to track large cryptocurrency wallets across the Tron, Solana, and Ethereum networks. The application monitors these whale wallets and transmits updates.
FomoPeek Malware Capable of Bypassing iOS Sandbox
The security organization observed that the application’s iOS build includes two components completely unrelated to its stated purpose. One component houses an iOS kernel exploit framework equipped with eight distinct techniques for targeting iOS.
The issue affected iOS releases 12.0 through 18.7 and 26.0 through 26.1, with the framework automatically choosing the appropriate exploit technique depending on the specific iPhone model and iOS edition. When successful, the application breaks out of the iOS sandbox environment to decrypt critical keychain records and examine files from other apps.
Consequently, nearly all confidential data on the handset becomes vulnerable to exposure, encompassing passcodes, seed phrases, private keys, messaging records, and additional sensitive details.
Furthermore, the FomoPeek utility can gather information and link up with concealed servers. Cybercriminals are also capable of transmitting remote directives to the software. Nonetheless, it appears the malicious code has since been eliminated, given that version 1.3 of the app—released on September 17—lacks these frameworks entirely.
Binance Urges Users to Move Assets, Uninstall FomoPeek, and Update iOS
Multiple digital asset trading platforms have already issued warnings to their communities concerning the event. Binance instructed iPad and iPhone users running iOS version 26.x and earlier who previously installed the utility to delete it immediately and refrain from ever installing it again.
The exchange additionally advised these individuals to upgrade their mobile operating systems to the most recent release, while noting that no incidents involving affected Binance customers had been reported.
Regarding its proprietary self-custody wallet service, the platform recommended that users transfer their funds to a brand-new wallet residing on a clean device that has never run FomoPeek.
Additional trading venues, such as OKX and Gate.io, which collaborated with SlowMist during the inquiry, have likewise warned their user bases.
This occurrence underscores the ongoing efforts of malicious actors to exploit mobile hardware in order to target digital asset holders. Throughout recent years, threat actors have increasingly utilized diverse strategies to compromise mobile devices and infiltrate crypto wallets.
Notably, such dangerous applications occasionally surface on official distribution platforms like the App Store and Play Store. A number of fraudulent crypto apps have previously made their way onto the App Store, such as a counterfeit Wasabi wallet that resulted in a user losing 6 BTC back in August.
This article is for informational purposes only. Users who may have installed affected software should follow guidance from official security providers and wallet platforms.
Frequently Asked Questions
What is FomoPeek?
FomoPeek is an iOS application that masqueraded as a read-only tool for tracking whale wallets on the Tron, Solana, and Ethereum blockchains, but was found to contain malicious code.
How does the FomoPeek malware steal crypto assets?
The malware uses an iOS kernel exploitation framework to escape the iOS sandbox, decrypt sensitive keychain data, and access all app files, exposing private keys, seed phrases, and login credentials.
Which versions of FomoPeek and iOS were affected?
Versions 1.1 and 1.2 of the FomoPeek app contained the malicious modules, while the issue impacted iOS versions 12.0 through 18.7 and 26.0 through 26.1.
What should I do if I installed FomoPeek?
Exchange security teams advise users to uninstall the app immediately, never redownload it, update iOS to the latest version, and transfer digital assets to a brand-new wallet on a device that has never had FomoPeek installed.