Malicious iOS app FomoPeek linked to $580K crypto theft, SlowMist says

A malicious iOS application named FomoPeek, distributed via Apple’s App Store, has been linked to the theft of nearly $580,000 in cryptocurrency. Security firm SlowMist identified kernel exploits that allowed the app to break out of Apple’s sandbox and read sensitive wallet data from other applications.

Technical details of the exploit

SlowMist’s investigation, conducted with the OKX security team, found that affected versions of FomoPeek introduced two malicious modules capable of exploiting iOS vulnerabilities, gaining elevated privileges, and accessing Keychain data and files belonging to other apps. The exploit framework comprised eight attack methods and claimed support for iOS versions from 12.0 up to 18.7.2 and 26.0 to 26.1.

Timeline of the malicious releases

• Versions containing the exploits were released on September 9 and September 12.
• Version 1.3, released on September 17, removed the malicious components.

On‑chain investigation

SlowMist’s on‑chain analysis traced a primary hacker address that received approximately 579,984 USDT. The address became active on September 15. The stolen funds moved across multiple blockchain networks, were consolidated, and then transferred through several addresses and services.

Funds movement

Portions of the stolen assets were sent to services including FixedFloat, KuCoin, and cce.cash. Additional funds were dispersed through other addresses that SlowMist continues to monitor.

Responses

Cointelegraph reached out to Apple, SlowMist, and OKX for comment but did not receive a response before publication.