Malicious iOS App Targets Crypto Wallets Through ‘Poisoning’ Attack
TREE NEWS reports: A seemingly ordinary food delivery application called “ComeCome” (拜托拜托) has been flagged for allegedly embedding malicious components designed to compromise iPhone users’ cryptocurrency assets. The app appears to deploy a “poisoning” attack similar to the previously identified FomoPeek campaign, where benign-looking apps silently download remote malicious code after installation to target installed wallets and sensitive data.
How the Attack Works
The reported attack vector is particularly insidious because it bypasses the traditional App Store review process. Once installed, the app can receive remote instructions to execute malicious payloads, scanning for wallet applications, seed phrases, or private keys stored on the device. This “post-install” attack model means even apps that initially pass security checks can later become weapons.
- Malicious code is delivered remotely after installation
- Targets installed crypto wallets and sensitive data
- Affects iPhone, iPad, and Mac devices
- Similar to the previously disclosed FomoPeek attack
Industry Implications
This incident highlights a growing convergence between traditional mobile malware and crypto-focused theft. As retail adoption of crypto wallets on mobile devices increases, attackers are shifting tactics from on-chain exploits to endpoint compromise. For the crypto industry, this represents a serious operational security challenge: users can follow every best practice for seed phrase storage and still lose funds if their device is compromised at the OS level.
The attack also underscores the importance of timely OS updates. Security researchers have emphasized that users should update to the latest iOS version immediately, as Apple frequently patches the kinds of vulnerabilities that enable remote code execution. However, the responsibility cannot rest solely on users — wallet developers may need to explore hardware-backed secure enclaves and stronger sandboxing to protect keys even on compromised devices.
Forward-Looking Perspective
As crypto assets become more valuable and mainstream, mobile-based attacks will likely intensify. The industry should anticipate a rise in supply-chain and app-store-level threats, pushing wallet providers toward multi-party computation (MPC), hardware wallets, and biometric-gated key storage. Regulators may also take a closer look at app store security standards. For now, the immediate takeaway is clear: users should audit installed apps, avoid unknown sources, and treat their phone as a potential attack surface — not just their wallet.
