Binance Alerts iPhone Users to FomoPeek Malware Threat

Binance has issued a security notice for iPhone and iPad users after researchers linked versions 1.1 and 1.2 of the FomoPeek app to malware that can extract private keys, seed phrases, login credentials and other data stored on the device.

Malware capabilities

The malicious code exploits iOS vulnerabilities to gain high‑level privileges, escape the sandbox, decrypt Keychain data and access files belonging to other applications. It can then transmit private keys, wallet recovery phrases, account credentials, chat records and locally stored files to remote servers.

Technical findings

Security firm SlowMist, working with the OKX security team, identified two hidden modules in FomoPeek 1.1 (build 105) and 1.2 (build 110). One module contains an iOS kernel exploitation framework with eight methods, targeting iOS 12.0‑18.7.2 and iOS 26.0‑26.1. Version 1.3 (build 111) removed these modules.

Recommended actions for users

• Remove FomoPeek from devices running iOS 26.x or earlier.
• Update the operating system to the latest iOS version.
• Create a new self‑custody wallet on a clean device that never had FomoPeek installed.
• Transfer assets to the new wallet address.
• Preserve any compromised device and evidence before contacting Binance support if unusual activity is observed.

Broader context of mobile crypto malware

FomoPeek joins a series of mobile threats targeting crypto users, including SparkKitty, Coruna, fake wallet apps such as Wasabi and Ledger clones, and the BOM malware that compromised over 13,000 wallets across multiple chains.