FomoPeek App Exploit Exposes iOS Users to Data Theft

Kucoin

FomoPeek App Exploit Exposes iOS Users to Data Theft

First seen 20 Sep 2026, 12:53 UTC • •67.5

Article Content

1 / 4

Browse articles

ThreatCluster •September 20, 2026 at 14:21 UTC

•FomoPeek app versions 1.1–1.2 contain malicious code targeting iOS devices.
•Users are advised to delete the app and update their iOS immediately.
•The DarkSword exploit toolkit poses additional risks to iOS security.

A security incident involving the FomoPeek app has been disclosed, affecting iPhone and iPad users with versions 1.1–1.2. The app contains malicious code that exploits iOS vulnerabilities, allowing unauthorized access to sensitive data across the device. Users who have installed the app are advised to delete it and update their iOS to the latest version. The DarkSword exploit toolkit has also been mentioned as a related threat, capable of exploiting unpatched vulnerabilities through malicious links. Both threats highlight the importance of maintaining device security and avoiding untrusted apps. Users are urged to create new wallets on clean devices if they have used FomoPeek. The incident has garnered attention from multiple security firms, including SlowMist, indicating a broader concern for iOS device security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-19

Binance issues security advisory

Binance warns iPhone users about the FomoPeek app containing malicious code that exploits iOS vulnerabilities.

X

2026-09-20

Kucoin reports on FomoPeek and DarkSword

Kucoin highlights the FomoPeek security incident and the DarkSword exploit toolkit, emphasizing the need for device security.

More articles in this cluster (3)

Threat Graph

12 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
Malware
T1041 - Exfiltration Over C2 Channel
T1068 - Exploitation for Privilege Escalation

Organization (1)

Binance

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-269 - Improper Privilege Management

Indicator (1)

wheelx.fi

Malware (2)

DarkSword
FomoPeek

Affected Platform (1)

IOS

Tool (1)

DarkSword Exploit Toolkit

Relationships

DarkSword communicates with wheelx.fi
FomoPeek communicates with wheelx.fi
DarkSword targets Binance
FomoPeek targets Binance
Data Breach targets IOS
Malware targets IOS
T1041 - Exfiltration Over C2 Channel targets IOS
T1068 - Exploitation for Privilege Escalation targets IOS
DarkSword related to CWE-200 - Exposure of Sensitive Information
DarkSword related to CWE-269 - Improper Privilege Management
DarkSword related to DarkSword Exploit Toolkit

Following this threat?

Track DarkSword and Binance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Iranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents On September 15, 2026, the UK, US, and Netherlands issued a joint advisory regarding a spyware campaign attributed to Iranian state actors targeting dissidents, activists, and journalists. The malware, known as CHOSEN BRICK, is delivered through spear-phishing attacks on messaging platforms like WhatsApp and Telegram.…

Malicious Packagist Themes Exploit iPhones for Spyware and Crypto Theft Thirteen malicious Composer theme packages on Packagist have been identified, targeting unpatched iPhones by injecting JavaScript into Vietnamese movie and comic streaming sites. The injected code facilitates mobile ad fraud and gambling redirects, while also deploying a WebKit-to-kernel exploit chain that installs…