- Published on
Malicious iOS app FomoPeek linked to $580K crypto theft, SlowMist says
- Authors
- Name
- DeepHorus
Blockchain security firm SlowMist has linked a malicious iOS application called FomoPeek to the theft of nearly $580,000 in cryptocurrency, warning that the app bypassed Apple's sandbox protections using kernel exploits to access sensitive wallet data from other apps installed on victims' devices. The finding marks a rare instance of an App Store-distributed app carrying kernel-level exploit code capable of cross-application data theft, raising fresh questions about Apple's review process for iOS applications.
SlowMist's investigation began after users reported stolen assets, and researchers found that several victims had previously installed affected versions of FomoPeek. Working alongside the OKX security team, SlowMist traced the malicious activity back to two specific releases of the app and mapped out how the exploit framework operated once launched on a victim's device.
According to SlowMist, the affected versions of FomoPeek were released on September 9 and September 12, while version 1.3, published on September 17, removed the malicious components. Onchain analysis identified a primary hacker address that received approximately 579,984 USDT beginning September 15, with stolen funds consolidated across multiple blockchain networks and laundered through several addresses and services.
Technically, the exploit framework embedded in FomoPeek included eight attack methods and declared support for iOS versions ranging from 12.0 to 18.7.2 and 26.0 to 26.1. SlowMist emphasized that no Safari browser or malicious webpage was involved; the framework loaded automatically when the app launched, while a remote server controlled exploitation and data collection functions. The server configuration named 19 wallet and note applications as targets, including MetaMask, Trust Wallet, SafePal, OKX Wallet, and Apple Notes.
SlowMist confirmed in a controlled environment that the framework could collect application data, including the Apple Notes container, though it cautioned this did not prove a private key or seed phrase was extracted from every targeted wallet. Users who installed versions 1.1 or 1.2 were urged to treat exposed credentials as compromised, create a new wallet on an unaffected device, and migrate assets immediately, since disabling Lockdown Mode or uninstalling the app cannot recover already-exfiltrated data.
SlowMist's disclosure underscores the escalating sophistication of mobile crypto attacks, as adversaries increasingly target app sandboxes and kernel vulnerabilities rather than relying on phishing alone. The incident also reignites debate over whether Apple's App Store review process is equipped to detect kernel-level exploits hidden within seemingly legitimate applications.
Onchain tracing revealed stolen funds were routed through services including FixedFloat, KuCoin, and cce.cash, with SlowMist continuing to track dispersed addresses. Cointelegraph reached out to Apple and OKX for comment but did not receive responses before publication.
The FomoPeek case fits into a broader pattern of supply-chain-style attacks targeting the mobile crypto ecosystem, where compromised app updates silently harvest seed phrases and private keys. As cross-chain laundering techniques grow more complex, security researchers expect regulators and app marketplaces to face increasing pressure to harden review pipelines against malware capable of operating at the kernel level.
