On September 19, blockchain security firm SlowMist issued a theft warning, then published a full technical analysis conducted jointly with the OKX security team. The finding: FomoPeek, an app listed on Apple's App Store, shipped malicious modules in versions 1.1 and 1.2 capable of iOS kernel exploitation, sandbox escape, Keychain decryption and cross application data collection, with crypto wallet private keys and seed phrases as the target.
This was not an ordinary phishing case. The malicious code did not come from a third party re signed build, a jailbreak or a sideload. It reached users through the official App Store, inside the package the developer submitted to Apple.
An App That Looked Entirely Legitimate
From the outside, FomoPeek showed nothing suspicious.
It was listed normally on the App Store, had a website and social accounts, and presented itself as a read only on chain monitoring and alerting tool that tracked whale wallet activity across Solana, Ethereum and TRON. It did not connect to wallets or ask for seed phrases. Neither Apple's reviewers nor its users had much chance of linking its appearance to kernel exploitation.
Its distribution method is more revealing. According to promotional material collected by SlowMist, FomoPeek spread mainly through crypto KOLs and communities. Users needed a referral code to download and register the app from the App Store, set a security code, add wallets to monitor, then keep the app running on a physical device for several minutes. After review they received 5 to 7 USDT. Some promotions stressed that each iPhone had only one chance, that multiple accounts on one device were invalid, and that a real device was required for 5 to 7 minutes.
Those rules look like anti farming measures, but they line up closely with the technical requirements of the implant. One exploitation strategy embedded in the sample takes more than two minutes per run, and a cloud phone cannot complete the process. SlowMist notes carefully that the promotional rules are supporting evidence only and cannot establish malicious intent on their own.
The timeline is also unusual. Only about ten days passed between domain registration and App Store listing, and the effective date of the privacy policy predates the domain registration by two days. The entire web identity and distribution chain was assembled in a short window from late August to early September. On top of that, the App Store privacy label declared that no data was collected, while FomoPeek's own privacy policy listed device identifiers, push tokens, email addresses, password hashes and two factor security codes. Even setting the kernel exploit aside, those two statements contradict each other.
How the Attack Chain Worked
SlowMist obtained historical builds through official App Store channels and compared them version by version.
Version 1.0, listed on August 29, contained no malicious modules. Version 1.1, released September 9, introduced two frameworks, apptrace and libapptracecore. Version 1.2 on September 12 carried the same code. Version 1.3 on September 17 removed both frameworks entirely, shrinking the package from 10.47 MB to 1.81 MB. The confirmed risk window runs from September 9 to September 17.
The two modules had clear roles. apptrace handled communication with the command and control server, while libapptracecore handled exploitation and data collection. The main binary loaded both as non weak dependencies, which means they entered the process whenever the app launched, regardless of whether any business code called them.
The kernel exploitation framework contained eight strategies that automatically matched the device model and system version, with declared coverage spanning iOS 12.0 to 18.7.2 and iOS 26.0 to 26.1. The built in device table included iPhone and iPad models released between 2023 and 2025, so older hardware was not the only target. On success, the code could obtain kernel read and write primitives, escalate privileges, escape the app sandbox and decrypt the system Keychain.
The control channel was equally practiced. On launch, the app fetched an encrypted string from a public Bitbucket repository and decrypted it to obtain the real C2 address. The repository was created on August 4, and its README and .gitignore were default templates used purely as cover. By editing that one public file, the attacker could swap the C2 address for every affected device without shipping an app update. The decrypted C2 domain was registered on September 12, the same day version 1.2 went live.
The decisive evidence came from dynamic testing. In an isolated environment, SlowMist found the server returned the exploit switch in the off position. After hooking the response to turn it on, the client immediately received a collection target list covering 19 wallet and note taking apps, including Gate Web3, SafePal, OKX Wallet, MetaMask, Trust Wallet, imToken, TokenPocket and TronLink. Collection paths concentrated on keystore files, SQLite, MMKV, React Native local storage and Keychain access groups, along with the entire Apple Notes container. The test device's Notes data was then packaged and uploaded to the attacker's server.
A separate endpoint reported all 135 apps installed on the device, letting the server decide which wallets were present and which collection list to deliver. The full chain reads: remote configuration, kernel exploitation and privilege escalation, targeted collection, packaging and exfiltration.
The money left a trail as well. SlowMist's MistTrack traced a primary attacker address that became active on September 15 and received a total of 579,984.34 USDT. Funds moved across Ethereum, BNB Chain, Arbitrum and TRON, were consolidated through cross chain and swap platforms, then dispersed in batches to services such as FixedFloat. One downstream TRON address received more than 2.12 million USDT in total before the funds were scattered toward suspected OTC platforms.
What Affected Users Should Do
SlowMist's guidance is blunt: deleting the app or upgrading to 1.3 does not make the device safe. Once the framework ran successfully, the data it read had already left the phone.
Anyone who installed version 1.1 or 1.2 should treat the relevant seed phrases, private keys and sensitive credentials as compromised. The correct response is to create a new wallet with a freshly generated seed phrase on a clean device that never ran the app, move assets there, and never reuse the old keys. Users should also review transfers and approvals across chains, revoke unused approvals, change any passwords used on the device, enable two factor authentication, and check whether any configuration profile or MDM has been installed.
Conclusion
What deserves attention here is not that another malicious app got caught. It is that the entry point has moved.
For years the industry taught users a simple rule: download from the official store. FomoPeek marks the limit of that rule. The malicious frameworks and the main binary shared the same Apple signing identity, and the package retained FairPlay encryption metadata, meaning this was a genuine build submitted by the developer, approved by Apple and distributed through official channels. Review did not stop a complete kernel exploitation framework, because statically there were no traces of the main program calling it. The capability sat dormant until a remote server woke it.
SlowMist describes this pattern as app poisoning, or poisoning of a trusted channel. The logic mirrors a watering hole attack: rather than chasing each target, the attacker occupies an entry point the target group already trusts and uses daily, then waits for them to walk in. SlowMist points to another documented case, ComeCome, a food delivery app serving Chinese users in places like Dubai, which was found to contain a component capable of escaping the sandbox and reading wallet and Notes data.
For ordinary users, the practical takeaways are few but firm. Move private keys and seed phrases off any internet connected phone and use a hardware wallet where possible. Treat any campaign that offers small rewards for downloading an app and keeping it open on a real device as suspect. Do not assume an app is safe because it came from an official store.
For platforms, the question is sharper. When malicious capability can arrive with a version update, sit behind a remote switch and stay silent through review, how much protection does static review still provide? That question does not yet have an answer.