Malware-laden FOMO app stayed on Apple's App Store for a week

iPhone users have been told to update their iOS systems after security experts found crypto-stealing malware hidden in malicious Safari links and within the FOMO application.

Shān Zhang, Chief Information Security Officer at SlowMist, urged his followers on Saturday to move to the newest iOS version amid the spread of the DarkSword malware.

He said that iPhone models running iOS 13 through iOS 26.5 remain exposed to dangerous Safari hyperlinks that exploit a memory-corruption vulnerability in WebKit and JavaScriptCore.

This flaw lets attackers gain read and write access to the JavaScript layer.

From there, hackers can get past pointer authentication codes, break out of the WebContent sandbox, and raise kernel privileges to achieve root access and make unauthorized changes that allow them to drain crypto keys and wallet information.

Crypto trading platform FOMO denies hack of its iOS app

Read more: Google warns over 200 million iPhone crypto wallets at risk

FOMO official app carried malware for seven days

SlowMist also flagged crypto-draining malware in the official FOMO app versions hosted on Apple's store, which users may have installed after promotions by crypto influencers.

The security firm's investigation into the malicious apps found hidden modules with capabilities matching those of the DarkSword exploits, potentially leading to the theft of seed phrases and private keys.

The affected versions were live from September 9 through September 17.

SlowMist cautioned that merely updating or removing the app might not suffice, urging users to consider their "relevant seed phrases, private keys, and sensitive credentials as compromised."