FomoPeek App Injects Malicious Code to Steal Wallet Private Keys
On September 19, Cos, the founder of blockchain security firm SlowMist, issued a warning that an iOS application named FomoPeek was found to have embedded malicious SDKs, leading to the theft of cryptocurrency wallet assets from some iPhone users.
Public information shows that FomoPeek registered its domain (fomopeek.com) on August 28 this year and officially launched on September 7 after passing Apple's App Store review, initially claiming to be a "read-only" whale wallet tracking tool, asserting it could monitor large wallet movements on public chains such as Solana, Ethereum, and TRON, and explicitly promised in the app description that it "does not execute transactions, does not hold funds, and does not collect deposits." However, on September 13, versions 1.1 to 1.2 of the app were found to have two hidden modules embedded, one of which is a complete iOS kernel attack framework.
According to disclosures from SlowMist and the OKX security team, this attack framework integrates eight different exploit schemes that can automatically select attack paths based on device model and system version, known to affect iOS versions 12.0 to 18.7 and 26.0 to 26.1, covering almost all currently used iPhone devices. Upon successful attack, the app can bypass the iOS sandbox isolation mechanism, read and decrypt the system keychain, and access data files from other applications on the device, putting users' stored private keys, mnemonics, login credentials, chat records, and files at risk of leakage; the app also regularly connects to covert servers unrelated to public business to receive remote commands, with related attack functions remaining active during the investigation period.
SlowMist stated that it has received multiple reports of user asset theft, and after tracking, confirmed that each case was related to the use of the infected version of the app, leading to private key leakage; Binance Wallet also issued a simultaneous warning, emphasizing that once a device is compromised, not only cryptocurrency wallet applications are affected, but all data stored on the device. As of September 20, the app has been removed from all app stores, and the DNS resolution service for the related domain has also been taken offline, with the entire operation cycle from domain registration to complete shutdown taking about 23 days. As of now, the total amount of stolen assets has not been publicly disclosed.
Cos particularly reminded that due to the rampant trend of such attack methods, iPhone users should not download applications from unknown sources and should promptly update their systems to the latest version (currently iOS 27), but he also emphasized that system updates do not guarantee that new risks will not emerge in the future, stating, "The arms race between offense and defense is always upgrading."
From the perspective of risk and capital flow, such attacks disguise themselves as "read-only" tools to be listed in the Apple official app store, essentially exploiting the relatively lenient review standards of Apple's review mechanism for "read-only, no transaction permission" applications, first passing the review with a normal version to accumulate downloads and user trust, and then embedding malicious code through subsequent version updates—this is a typical path to bypass app store security reviews and shift the attack cost to the asset security of end users; once the private keys and mnemonics of victim users are leaked, on-chain assets can be directly and irreversibly transferred by attackers, and due to the anonymity and irreversibility of cryptocurrency transactions, the difficulty of recovery is much higher than that of traditional financial fraud, which is also the core reason why security agencies need to urgently disseminate warnings in conjunction with exchanges and wallet service providers after the incident, rather than relying solely on Apple's unilateral removal.
Source: Public Information
ABAB AI Insight
The method of disguising as a "compliant, read-only" tool to deceive the app store review process and then embedding malicious code through subsequent version updates has multiple precedents in the cryptocurrency security field—attackers generally exploit the app store's relatively lenient review mechanism for "updated versions" compared to "initial listings." In this case, FomoPeek registered its domain on August 28 and embedded malicious code by September 13, just about half a month later, continuing this historical pattern of "establishing trust first, then embedding attacks."
From the perspective of the attackers' resource investment path, building a complete iOS kernel attack framework that integrates eight exploit schemes and can automatically adapt to different device models and system versions requires considerable professional attack technical accumulation and upfront R&D investment. Such "professional-grade" attack tools are typically not used for one-time, small-scale scams but are instead utilized as reusable "attack infrastructure"—after the FomoPeek incident, it is not ruled out that the same attack framework may disguise itself as other applications to reappear, with attackers recycling resources along the path of "developing attack frameworks—packaging application shells—quickly taking them offline after profiting and changing shells."
This incident can be compared to previous cases of "fake wallets" and "fake tool" supply chain attacks in app stores—attackers do not directly attack the servers of exchanges or wallet service providers but instead circumvent by attacking the end devices themselves, reaching users through legitimate app store distribution channels. This "supply chain poisoning" model is one of the most covert and large-scale risk attack paths in the current cryptocurrency asset security field. In terms of the industry's current stage, as iOS device security mechanisms (sandbox isolation, keychain encryption, etc.) continue to strengthen, attackers are also upgrading their circumvention methods in tandem, with both sides currently in a continuous confrontation and the attack tools becoming increasingly professionalized.
Structural judgment: This incident represents a technological substitution. Traditional methods of cryptocurrency theft often rely on phishing links and social engineering techniques to induce users to actively disclose mnemonics, while the FomoPeek incident demonstrates a higher-level technical path—directly breaking through system security boundaries through kernel-level exploit frameworks and automating key theft without requiring users to actively "fall for it." This shift from traditional social engineering inducement to automated technical attacks is the core feature of this incident's evolution in attack methods.
ABAB News · Cognitive Law
Read-only tools can also become thieves.
The risk only starts counting from the day it passes the review.
Not updating your phone is like leaving the door unlocked.