On September 19, Cos, the founder of blockchain security firm SlowMist, issued a warning that an iOS application named FomoPeek was found to have embedded malicious SDKs, leading to the theft of cryptocurrency wallet assets from some iPhone users.

Public information shows that FomoPeek registered its domain (fomopeek.com) on August 28 this year and officially launched on September 7 after passing Apple's App Store review, initially claiming to be a "read-only" whale wallet tracking tool, asserting it could monitor large wallet movements on public chains such as Solana, Ethereum, and TRON, and explicitly promised in the app description that it "does not execute transactions, does not hold funds, and does not collect deposits." However, on September 13, versions 1.1 to 1.2 of the app were found to have two hidden modules embedded, one of which is a complete iOS kernel attack framework.

According to disclosures from SlowMist and the OKX security team, this attack framework integrates eight different exploit schemes that can automatically select attack paths based on device model and system version, known to affect iOS versions 12.0 to 18.7 and 26.0 to 26.1, covering almost all currently used iPhone devices. Upon successful attack, the app can bypass the iOS sandbox isolation mechanism, read and decrypt the system keychain, and access data files from other applications on the device, putting users' stored private keys, mnemonics, login credentials, chat records, and files at risk of leakage; the app also regularly connects to covert servers unrelated to public business to receive remote commands, with related attack functions remaining active during the investigation period.

SlowMist stated that it has received multiple reports of user asset theft, and after tracking, confirmed that each case was related to the use of the infected version of the app, leading to private key leakage; Binance Wallet also issued a simultaneous warning, emphasizing that once a device is compromised, not only cryptocurrency wallet applications are affected, but all data stored on the device. As of September 20, the app has been removed from all app stores, and the DNS resolution service for the related domain has also been taken offline, with the entire operation cycle from domain registration to complete shutdown taking about 23 days. As of now, the total amount of stolen assets has not been publicly disclosed.

Cos particularly reminded that due to the rampant trend of such attack methods, iPhone users should not download applications from unknown sources and should promptly update their systems to the latest version (currently iOS 27), but he also emphasized that system updates do not guarantee that new risks will not emerge in the future, stating, "The arms race between offense and defense is always upgrading."

From the perspective of risk and capital flow, such attacks disguise themselves as "read-only" tools to be listed in the Apple official app store, essentially exploiting the relatively lenient review standards of Apple's review mechanism for "read-only, no transaction permission" applications, first passing the review with a normal version to accumulate downloads and user trust, and then embedding malicious code through subsequent version updates—this is a typical path to bypass app store security reviews and shift the attack cost to the asset security of end users; once the private keys and mnemonics of victim users are leaked, on-chain assets can be directly and irreversibly transferred by attackers, and due to the anonymity and irreversibility of cryptocurrency transactions, the difficulty of recovery is much higher than that of traditional financial fraud, which is also the core reason why security agencies need to urgently disseminate warnings in conjunction with exchanges and wallet service providers after the incident, rather than relying solely on Apple's unilateral removal.

Source: Public Information