New iOS Malware Campaign Targets Crypto Users Through Everyday Apps
TREE NEWS reports: Blockchain security firm SlowMist has issued a fresh warning that ComeCome, a food delivery application, contains malicious code designed to poison and drain cryptocurrency wallets on iPhones. The disclosure follows an earlier alert involving a separate app, FomoPeek, which used a similar attack vector. SlowMist’s founder, known as Cosine, advised iOS users to update their operating systems immediately and to exercise caution when installing apps from outside official channels.
How the Attack Works
The scheme relies on tricking users into installing a tampered application — often distributed through sideloading, enterprise certificates, or phishing links — that then requests excessive permissions or exploits unpatched iOS vulnerabilities. Once inside, the malware can read clipboard data, intercept wallet seed phrases, or inject malicious transactions into legitimate wallet apps. The technique mirrors a growing class of “wallet drainer” attacks that have proliferated across both mobile and desktop environments.
Why Mobile Is the New Frontline
Mobile devices have become the primary interface for retail crypto users, especially in Asia where super-apps blend messaging, payments, and finance. That convenience creates a broad attack surface. Unlike desktop wallets, which benefit from hardware isolation and browser extensions, mobile wallets often rely on the same device used for social media and food delivery — making social engineering far more effective. Attackers no longer need to breach an exchange; they only need a user to tap “install.”
- SlowMist recommends immediate iOS updates to patch known vulnerabilities.
- Users should avoid sideloaded apps and verify developer signatures.
- Hardware wallets and passkeys remain the strongest defense against drainers.
Industry Implications
The ComeCome case underscores a structural weakness in the crypto security stack: the endpoint. As exchanges harden their custody systems and on-chain analytics improve, attackers are shifting to the user’s device. App stores, enterprise certificate programs, and regional distribution channels are all potential vectors. For wallets, this raises the bar on secure enclave integration, transaction simulation, and real-time phishing detection.
Forward-Looking Perspective
Expect regulators and platform operators to face pressure to tighten app review processes, particularly in markets where crypto adoption is high. Wallet developers will likely accelerate adoption of passkeys, biometric confirmation for every signature, and on-device threat detection. Users, meanwhile, should treat any app requesting wallet permissions as hostile until proven otherwise. The lesson is simple: in crypto, the weakest link is often the phone in your hand.
