Crypto-draining FOMO App was Live on Apple's App Store for 8 days

A malicious app called FOMO stayed on Apple's App Store for 8 days, from September 9 to September 17, with crypto-draining malware on board, blockchain security firm SlowMist found. SlowMist's chief information security officer, Shān Zhang, urged iPhone users to update to the latest iOS version after the discovery.

The app was promoted by crypto key opinion leaders and contained malware hidden in modules capable of stealing seed phrases and private keys. SlowMist's analysts also flagged a separate wave of crypto-stealing malware spread through malicious Safari links exploiting the same iOS flaw.

How the drain worked

The FOMO modules exploited a memory-corruption flaw in WebKit and JavaScriptCore, the engine pair that powers Safari and many in-app browsers on iPhone. According to Zhang, iOS versions 13 to 26.5 are vulnerable to malicious Safari links that use the same flaw, which analysts call DarkSword.

The flaw gives an attacker read and write access to the JavaScript layer, the part of a browser that runs page scripts. From there, the malware can bypass pointer authentication codes, escape the WebContent sandbox, and escalate to kernel privileges, the deepest level of access on an iPhone. That level of access lets the attacker exfiltrate crypto keys and wallet data.

What to do if you installed FOMO

Updating iOS or deleting the app may not be enough, SlowMist warned. The firm advised anyone who installed FOMO to treat their seed phrases, private keys, and other sensitive credentials as compromised, on the assumption they have been seen and copied.

Red flags the case surfaces

• KOL promotion is not a safety check. FOMO reached users through crypto influencer promotion, even with a malicious payload on board.
• An App Store listing is not a safety check either. FOMO passed Apple's review and stayed available for 8 days.
• A software update may not undo the damage. SlowMist's own warning said that for affected users, updating or deleting the app may not be enough.

SlowMist did not publish the total value of crypto drained, the number of victims, or the names of the key opinion leaders who promoted the app.