FOMO App含恶意代码致加密资产被盗，已在App Store下架
Crypto-draining FOMO app was available on Apple store for a week
涉及主流加密安全事件与具体操作指引，提醒持有者检查设备状态并重置敏感信息，对加密用户有直接参考价值。
Analysts have urged iPhone users to update their IOS after crypto-stealing malware was discovered in malicious Safari browser links and the FOMO app.
在恶意 Safari 浏览器链接和 FOMO 应用中发现窃取加密货币的恶意软件后，分析师敦促 iPhone 用户更新其 IOS。
SlowMist’s Chief Information Security Officer, Shān Zhang, encouraged his followers last Saturday to update to the latest version of IOS following the proliferation of DarkSword malware.
SlowMist 的首席信息安全官 Shan Zhang 上周六鼓励他的关注者随着 DarkSword 恶意软件的蔓延，更新至最新版本的 IOS。
He claims iPhone versions IOS 13 to IOS 26.5 leave you vulnerable to malicious Safari links that utilize a memory-corruption flaw in WebKit and JavaScriptCore.
他声称，IOS 13 至 IOS 26.5 版本的 iPhone 容易受到恶意 Safari 链接的攻击，这些链接利用 WebKit 和 JavaScriptCore 中的内存损坏漏洞。
This gives hackers access to the JavaScript layer for read and write access.
这使得黑客能够访问 JavaScript 层，从而获得读写权限。
Hackers can then bypass pointer authentication codes, escape the WebContent sandbox, and escalate kernel privileges in order to gain root access and make unauthorised changes allowing for the exfiltration of crypto keys and wallet data.
随后，黑客可以绕过指针认证代码，逃逸 WebContent 沙箱，并提升内核权限以获得 root 访问权限并进行未经授权的更改，从而窃取加密密钥和钱包数据。
Crypto trading platform FOMO denies hack of its iOS app
加密货币交易平台 FOMO 否认其 iOS 应用遭黑客攻击
Read more: Google warns over 200 million iPhone crypto wallets at risk
阅读更多：Google 警告超过 2 亿个 iPhone 加密钱包面临风险
FOMO official app contained malware for a week
FOMO 官方应用包含恶意软件长达一周
SlowMist also warned about crypto draining malware across official versions of the FOMO app on the App Store that users may have downloaded thanks to the promotion of crypto key opinion leaders.
SlowMist 还警告称，App Store 上 FOMO 应用的官方版本中存在跨平台的加密货币 draining 恶意软件，用户可能因加密货币关键意见领袖的宣传而下载了这些应用。
SlowMist’s report on the malicious apps found it contained malware hidden with modules that were similarly capable of the DarkSword exploits, and can lead to the theft of seed phrases and private keys.
SlowMist 对发现的恶意应用的报告指出，其中隐藏了与 DarkSword 漏洞利用能力相似的模块的恶意软件，可能导致助记词和私钥被盗。
The vulnerable versions were active between September 9 and September 17.
易受攻击的版本在 9 月 9 日至 9 月 17 日期间处于活跃状态。
SlowMist says updating or deleting the app may not be enough, and that users should treat their “relevant seed phrases, private keys, and sensitive credentials as compromised.”
SlowMist 表示，更新或删除该应用可能还不够，用户应将其“相关助记词、私钥和敏感凭证视为已泄露”。
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
有线索？通过 Protos Leaks 向我们发送安全电子邮件。如需更多明智的新闻和调查报道，请在 X、Bluesky 和 Google News 上关注我们，或订阅我们的 YouTube 频道。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力