iOS App FomoPeek Used Kernel Exploits to Steal $580K in Crypto

A malicious iOS app distributed on Apple’s App Store, called FomoPeek, has been linked to the theft of nearly $580,000 in cryptocurrency, according to a new report from blockchain security firm SlowMist.

SlowMist, which conducted its investigation with the OKX security team, said affected versions of the app contained multiple iOS kernel exploits that allowed it to escape Apple’s security sandbox. Once free, the app’s malicious modules could access sensitive data from other applications, including wallet and note apps.

The framework specifically targeted data from 19 applications, including MetaMask, Trust Wallet, SafePal, OKX Wallet, and Apple Notes. SlowMist’s onchain analysis traced the stolen funds, mostly in USDT, to a primary hacker address that became active on Sept. 15. The funds were consolidated and moved through various addresses and services, including FixedFloat and KuCoin.

SlowMist cautions that uninstalling the app or enabling security features like Lockdown Mode cannot retrieve data if it has already been copied off the device. The firm urges users who installed versions 1.1 or 1.2 of FomoPeek to create a new wallet on an unaffected device and move all assets to it, treating any exposed credentials as compromised.