Binance warns iPhone users of FomoPeek malware targeting crypto wallets

cryptonews09-21 14:35

Binance has warned iPhone and iPad users to check whether they have installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the app to malicious code capable of exposing private ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2669158310?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-09-21 14:35","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2669158310","market":"hk","top_or_hot":-1,"title":"Binance warns iPhone users of FomoPeek malware targeting crypto wallets","media":"cryptonews","content":"<div>\n<p>Binance has warned iPhone and iPad users to check whether they have installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the app to malicious code capable of exposing private ...</p>\n\n<a href=\"https://crypto.news/binance-warns-iphone-users-of-fomopeek-malware-targeting-crypto-wallets/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Binance warns iPhone users of FomoPeek malware targeting crypto wallets</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBinance warns iPhone users of FomoPeek malware targeting crypto wallets\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-21 14:35 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/binance-warns-iphone-users-of-fomopeek-malware-targeting-crypto-wallets/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Binance has warned iPhone and iPad users to check whether they have installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the app to malicious code capable of exposing private ...</p>\n\n<a href=\"https://crypto.news/binance-warns-iphone-users-of-fomopeek-malware-targeting-crypto-wallets/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":null,"symbol_name":null,"start_time":0,"source_url":"https://crypto.news/binance-warns-iphone-users-of-fomopeek-malware-targeting-crypto-wallets/","article_id":"2669158310","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/binance-warns-iphone-users-of-fomopeek-malware-targeting-crypto-wallets/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2669158310","pubTimestamp":1789972558,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Binance has warned iPhone and iPad users to check whether they have installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the app to malicious code capable of exposing private keys, seed phrases and other data stored across affected devices.Binance has warned iPhone and iPad users after malicious code was discovered in FomoPeek versions 1.1 and 1.2.The malware could exploit iOS vulnerabilities to access private keys, seed phrases, login credentials and data stored by other apps.Affected self custody users were advised to create new wallets on clean devices and transfer their assets to the new addresses.According to Binance, the warning follows a security incident disclosed by the community and findings from blockchain security firms including SlowMist, which found that the affected FomoPeek versions could exploit vulnerabilities in Apple’s iOS operating system and obtain high level privileges on a device.Once an exploit succeeded, the malicious code could escape ","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{},"translate_title":"币安警告 iPhone 用户注意针对加密钱包的 FomoPeek 恶意软件","themeId":null,"isJumpTheme":false,"ttsUrl":"https://static.tigerbbs.com/8af67b6f058939aeb852d3cfbea877ad","symbols_score_info":{"AAPL":1.84,"IOSX":0.6,"VT":0.6,"AAPW":0.6,"JGRO":0.6,"SPTE":0.6,"AAPX":0.6,"AAPY":0.6,"MACW.SI":0.6,"AAPB":0.6,"APLY":0.6,"CMAG":0.6,"XLK":0.6,"AAPD":0.6,"TTXU":0.6,"VGT":0.6,"AAPU":0.6,"TYLG":0.6,"AAPE":0.6,"ROM":0.6,"ABFL":0.6,"IXN":0.6,"METV":0.6,"SAAPLmain":0.6,"FTEC":0.6},"content_text":"Binance has warned iPhone and iPad users to check whether they have installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the app to malicious code capable of exposing private keys, seed phrases and other data stored across affected devices.\n\n\nSummary\n\n\n\nBinance has warned iPhone and iPad users after malicious code was discovered in FomoPeek versions 1.1 and 1.2.\nThe malware could exploit iOS vulnerabilities to access private keys, seed phrases, login credentials and data stored by other apps.\nAffected self custody users were advised to create new wallets on clean devices and transfer their assets to the new addresses.\n\n\n\nAccording to Binance, the warning follows a security incident disclosed by the community and findings from blockchain security firms including SlowMist, which found that the affected FomoPeek versions could exploit vulnerabilities in Apple’s iOS operating system and obtain high level privileges on a device.\n\n⚠️ Security Advisory | iPhone Users: Check Whether You’ve Ever Installed the FomoPeek AppBinance is aware of a security incident recently disclosed by the community. According to security firms including SlowMist, the third-party app FomoPeek (versions 1.1–1.2) contains… pic.twitter.com/DwLwHIBVB2— Binance Wallet (@BinanceWallet) September 19, 2026\n\nThe malware targets the device itself instead of a specific crypto application, Binance said. A successful attack could therefore expose information held by other apps, including login credentials, chat records and files alongside cryptocurrency wallet data.\nUsers who have installed FomoPeek and run iOS 26.x or an earlier version should remove the application, avoid reinstalling it and update their operating system to the latest available version, according to Binance.\nSelf custody wallet users were advised to use a separate device that has never had FomoPeek installed to create a new wallet and transfer their assets to the new address. Binance asked anyone who detects unusual asset activity to preserve the affected device and relevant evidence before contacting customer support.\nFomoPeek malware could escape the iOS sandbox\nSlowMist’s investigation provided more detail on how the malicious versions operated after the security firm received multiple reports of stolen assets involving private key exposure.\nWorking with the OKX security team, researchers found two modules inside FomoPeek versions 1.1 and 1.2 that were unrelated to the application’s advertised functions. One contained an iOS kernel exploitation framework equipped with eight exploit methods, allowing it to select an attack method based on the device model and operating system version.\nThe framework’s declared coverage included iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1, according to the researchers. SlowMist said older versions of iOS generally faced a higher level of risk.\nOnce an exploit succeeded, the malicious code could escape the iOS sandbox, decrypt Keychain data and access files belonging to other applications. Such access could expose private keys, wallet recovery phrases, account credentials, conversations and locally stored files.\nResearchers found that the malicious code communicated with infrastructure unrelated to FomoPeek’s public services and could receive remote instructions. Analysis of its communications showed that operators could control exploit execution and how frequently the process ran.\nHistorical versions obtained through the official App Store showed that FomoPeek 1.0 did not contain the two malicious frameworks. Version 1.1, build 105, introduced them on Sept. 9, while version 1.2, build 110, retained the code after its Sept. 12 release.\nVersion 1.3, build 111, removed both frameworks on Sept. 17, according to the security analysis. The affected 1.1 and 1.2 versions had been distributed through Apple’s official App Store instead of third party or re-signed installations.\nCrypto wallet malware has repeatedly targeted mobile devices\nMobile devices have remained a target for malware designed to obtain crypto wallet credentials. In July, crypto.news previously reported on the SparkKitty mobile spyware, which could collect images from infected iOS and Android devices and send them to servers controlled by attackers.\nKaspersky had initially detailed the malware in June 2025 after finding infected applications distributed through Apple’s App Store, Google Play and unofficial channels. SparkKitty sought wallet recovery phrases, passwords and other sensitive information that users had stored as images on their phones.\nAn earlier malware family called SparkCat used optical character recognition to scan images for cryptocurrency recovery phrases. Some infected applications carrying the malicious software had reached official app stores, while Kaspersky said the campaign had been active since March 2024.\nResearchers have found other methods for compromising iPhones without relying on users storing seed phrase screenshots. In March, Google’s Threat Intelligence Group identified an iPhone exploit kit known as Coruna that contained five complete exploit chains and 23 vulnerabilities.\nThe framework targeted devices running versions between iOS 13 and iOS 17.2.1 and could search compromised phones for cryptocurrency wallet recovery phrases and financial information. Google researchers said the toolkit had moved through different groups over time, including financially motivated cybercriminals.\nMalicious apps have reached Apple’s App Store\nCrypto users have faced separate threats from applications that impersonate legitimate wallet software.\nIn August, a fake Wasabi Wallet app appeared on Apple’s App Store and was linked by security monitoring reports to the theft of roughly 6 BTC from one victim.\nThe fraudulent listing was identified as the 27th reported crypto wallet clone found on the App Store during 2026 at the time. A fake Ledger application represented the largest reported case among the clones, with roughly $9.3 million stolen.\nAnother fake Ledger Live app had previously been linked to the loss of 5.9 BTC worth roughly $420,000 from American musician Garrett Dutton, known professionally as G. Love.\nDutton downloaded software posing as the Ledger Live manager onto a new MacBook Neo and entered his recovery phrase into the fraudulent application. Blockchain records showed the stolen Bitcoin subsequently moving to several deposit addresses associated with the KuCoin exchange.\nUnlike wallet impersonation schemes that depend on convincing a user to manually surrender a recovery phrase, SlowMist’s FomoPeek findings describe malicious code capable of obtaining elevated system access and collecting information from other applications after exploiting the operating system.\nEarlier mobile malware drained thousands of crypto wallets\nSlowMist has previously investigated malicious applications that obtained wallet information directly from users’ devices.\nIn February 2025, the security firm reported that a fake application called BOM had compromised more than 13,000 wallets across Android and iOS, with estimated losses exceeding $1.82 million.\nThe application requested access to files, photos and media before scanning device storage for private keys and mnemonic phrases and transmitting the information to a remote server, according to the investigation.\nOnchain analysis linked the main attacker address to stolen assets that moved across BNB Chain, Ethereum, Polygon, Arbitrum and Base. The affected cryptocurrencies included USDT, Ethereum, Wrapped Bitcoin and Dogecoin.\nFor FomoPeek users, SlowMist recommended checking accounts for unauthorized activity and generating a new private key and seed phrase on a trusted device where the affected application had never been installed. Assets held in wallets potentially exposed through versions 1.1 or 1.2 should then be moved to the newly generated wallet.\nBinance gave similar instructions in its security notice, while advising users to keep their device software updated and avoid applications obtained from untrusted sources.\n\n\n\n\n\n                Read more:\n            \n\n                Shibarium reorg resolved as dRPC migration continues","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.50.1","shortVersion":"4.50.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2669158310","isCrawlerRequest":true}