Malicious SDK Targets iOS Crypto Wallets Through Delivery App
TREE NEWS reports: A food delivery app called ComeCome (comecome.icu) has been identified as carrying a malicious SDK designed to exploit iOS kernel vulnerabilities and steal cryptocurrency wallet assets. The attack mirrors the earlier FomoPeek poisoning incident, in which versions 1.1–1.2 embedded a malicious SDK integrating eight distinct iOS kernel exploit methods. The malware automatically selects an attack vector based on device model and operating system version, with known affected iOS versions spanning iOS 12.0–18.7 and 26.0–26.1. Once successful, the exploit breaks through the iOS sandbox and gains access to wallet data.
Attack Mechanics and Scope
The sophistication of the toolkit suggests a well-resourced threat actor. By bundling multiple kernel exploits, the malware can target a wide range of devices without requiring user interaction beyond installing the app. Yu Xian warned that the threat may extend beyond iPhone to iPad and Mac devices, urging users to update to the latest iOS version and exercise extreme caution with apps from unknown sources.
This incident follows a broader pattern of supply-chain attacks targeting crypto users through seemingly innocuous applications. Delivery, fitness, and utility apps are particularly effective vectors because they request extensive permissions and are often sideloaded or downloaded from third-party stores in regions where official app store access is limited.
Industry Implications
- Mobile wallet security: The attack underscores that even sandboxed mobile operating systems are not immune to sophisticated kernel-level exploits, challenging the assumption that mobile wallets are inherently safer than desktop or browser-based alternatives.
- App store vetting gaps: The presence of such malware on an app distributed outside major app stores highlights the risks of sideloading and the difficulty of policing third-party distribution channels.
- User behavior: Crypto holders are increasingly targeted through everyday apps, meaning security hygiene must extend beyond wallet management to general device usage.
Forward-Looking Perspective
The ComeCome and FomoPeek cases signal an escalation in mobile-focused crypto crime. As iOS and Android harden their sandboxes, attackers are investing in kernel-level exploits that bypass traditional defenses. Expect to see more cross-platform exploit kits and a growing market for zero-day vulnerabilities targeting mobile operating systems.
For users, the practical takeaways are clear: update devices promptly, avoid sideloaded apps, and consider using hardware wallets for significant holdings. For the industry, the incident reinforces the need for continuous security auditing of mobile applications and greater collaboration between security researchers, app stores, and law enforcement to disrupt these supply chains before they reach users.
