Slow Fog and OKX Confirm Kernel-Level Spy Code Embedded in FomoPeek App
Slow Fog issued a warning: versions 1.1 to 1.2 of the FomoPeek app are related to multiple incidents of private key leaks and asset theft, with some victims having downloaded and used these versions. Slow Fog and the OKX security team jointly analyzed that the app, in addition to its claimed business, bundles two unrelated modules, one of which contains an iOS kernel attack framework, integrating eight exploitation schemes that can automatically select based on device model and system version, affecting iOS versions 12.0 to 18.7 and 26.0 to 26.1.
The team stated that upon successful attack, it can break out of the sandbox, read and decrypt the system keychain, and access data files of other applications on the device. Private keys, mnemonics, login credentials, chat records, and files within the device may be exposed. The app also connects to hidden servers unrelated to public business to receive remote commands; intercepted communications show that the attack functions are active and executed regularly. The lower the system version, the higher the risk.
This app is packaged as a read-only whale address monitoring and on-chain alert tool, claiming not to host, trade, or collect funds. The security advice is: generate new keys and create new accounts on devices that have never installed this app, transfer assets as soon as possible, upgrade to the latest iOS, and do not continue to use or reinstall it; if abnormal transfers occur, contact the platform and retain evidence from the device.
This is not an ordinary phishing page, but a client that can access other wallet containers on the same device after being installed. Deleting the app itself does not prove that the keychain has not been read, hence the emphasis on changing devices and keys, rather than just uninstalling the software.
In terms of market mechanisms, this reflects a shift of trust from the app store icon back to hardware isolation. What is sold is the free tool traffic of "smart money"; what is bought is hardware wallets and new device migrations. Funds flow out from stolen addresses through exchanges and mixing channels; beneficiaries are hardware wallets and security audits, while the burden falls on users who have both monitoring tools and hot wallets installed on the same iPhone.
The warning targets users who have installed versions 1.1 to 1.2, and does not cover whether other versions are clean.
Source: Public Information
ABAB AI Insight
Monitoring apps require notification permissions and persistence, while kernel frameworks require access to the keychain. Bundling both in the same IPA leads users to believe they are monitoring on-chain whales, while the device selects vulnerabilities based on version. The collaboration between Slow Fog and OKX elevates the incident from individual thefts to a risk for all devices: it is not just FomoPeek's own data that is read, but also that of other wallets on the same device.
The capital path is to exchange free tools for installation volume, and remote servers for switchable spying capabilities. Once communication shows the functionality is active, the migration window is measured in hours. The security industry employs the same response: new device, new entropy, severing old addresses, rather than patching the old phone and continuing to use the original keys.
Similar cases include fake wallet apps scanning photo albums and browser vulnerabilities reading the keychain. Mobile security is in a phase of control failure: the sandbox is treated as the default security boundary, and once the kernel is exploited, the boundary fails for all financial applications on the same device.
This represents a shift in attack surfaces within technical substitutions. The mechanism is that users hand over their private keys to the operating system's vault, and malicious apps read the vault as if it were a regular file. The more an app's functionality resembles a tool and less like a wallet, the lower the scrutiny and user vigilance, which is precisely where bundled modules aim to position themselves.
ABAB News · Cognitive Laws
When monitoring tools are on the same phone, the keychain is no longer isolated
Uninstalling the app does not mean the keys have not been read
The older the system, the more expensive the free tools