Researchers from SlowMist reported several incidents of asset theft from users of the iOS version of the FomoPeek app. The investigation uncovered malicious code that intercepted seed phrases from cryptocurrency wallets.
According to experts, all confirmed cases involved the leakage of private keys. Some victims had previously installed and used FomoPeek versions 1.1 and 1.2.
Devices running iOS versions 12.0-18.7 and 26.0-26.1 are at risk.
These builds contained two extraneous modules unrelated to the app’s stated functions. One of them includes DarkSword frameworks for iOS kernel hacking with eight attack methods and can automatically select the appropriate option based on the device model and OS version.
If successfully implemented, the app can escape the sandbox, access Keychain data, decrypt it, and read files from other apps on the device.
Researchers also stated that the app connects to hidden servers unrelated to FomoPeek’s public services and can receive remote commands.
According to SlowMist, the attack functionality is already enabled and launches automatically at periodic intervals. Devices running older iOS versions are considered more vulnerable.
FomoPeek users are advised to check their accounts for suspicious activity, create a new account with a new seed phrase and private key on a trusted device, and transfer assets as soon as possible.
SlowMist also recommended updating iOS to the latest available version, not reinstalling the app, and contacting official support of the respective platform if signs of compromise are detected, preserving the device and materials related to the incident for investigation.
In April, scammers stole $9.5 million through a phishing app Ledger in the App Store.
