Binance has warned iPhone and iPad users to check whether they installed FomoPeek versions 1.1 or 1.2 after security researchers linked the releases to malicious code. The malware targeted the device rather than a specific crypto application and could exploit iOS vulnerabilities to obtain elevated privileges, escape the iOS sandbox (a system that isolates apps), decrypt Keychain data and access information held by other applications. Potentially exposed material included private keys, seed phrases, login credentials, chat records and locally stored files. SlowMist, working with the OKX security team, found two modules unrelated to FomoPeek’s advertised functions, including an iOS kernel exploitation framework with eight exploit methods. The framework listed support for iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1, with older iOS versions generally facing greater risk. FomoPeek 1.1, build 105, introduced the modules on Sept. 9, while version 1.2, build 110, retained them after its Sept. 12 release. Version 1.3, build 111, removed both frameworks on Sept. 17. The affected releases had been distributed through Apple’s official App Store. Binance told users running iOS 26.x or an earlier version to remove FomoPeek, avoid reinstalling it and update their operating system. Self-custody wallet users were advised to create new wallets on clean devices and transfer assets to the new addresses. Users detecting unusual activity should preserve the affected device and relevant evidence before contacting customer support. The incident adds to a series of mobile threats targeting crypto credentials, including SparkKitty, SparkCat and the Coruna exploit kit, as well as fake wallet applications distributed through official app stores. SlowMist previously said the fake BOM application compromised more than 13,000 wallets across Android and iOS, with estimated losses exceeding $1.82 million.