[Update 09:15 UTC, Sept. 23: This article was updated with comments from SlowMist on how FomoPeek operated, what its researchers verified and its advice for people who installed affected versions.]
A malicious iOS app distributed through Apple’s App Store has been linked to nearly $580,000 in stolen crypto after researchers found it contained multiple kernel exploits capable of escaping Apple’s sandbox and accessing sensitive wallet data.
According to an investigation published by blockchain security firm SlowMist, the app, called FomoPeek, introduced two malicious modules that could exploit iOS vulnerabilities, gain elevated privileges and access Keychain data and files belonging to other apps.
SlowMist said the affected versions were released on Sept. 9 and Sept. 12, while version 1.3, released Sept. 17, removed the malicious components.
SlowMist said its investigation, conducted with the OKX security team, began after it received reports from users who had suffered asset theft and found that some had previously installed the affected FomoPeek versions.
The exploit framework included eight attack methods and declared support for iOS versions ranging from 12.0 to 18.7.2 and 26.0 to 26.1.
FomoPeek targeted wallet and notes app data
“For FomoPeek specifically — no. No Safari or webpage is involved at all,” SlowMist told Cointelegraph when asked whether the attack required users to open a malicious page. It said the framework loaded when the app launched, while a remote server could control its exploitation and data collection functions.
SlowMist said the server’s configuration named 19 wallet and note apps as targets, including MetaMask, Trust Wallet, SafePal, OKX Wallet and Apple Notes.
“We confirmed the framework’s ability to collect application data in our controlled environment, including the Apple Notes container,” the company said. It cautioned that this did not establish that a private key or seed phrase had been extracted from every named wallet.
SlowMist’s onchain analysis identified a primary hacker address associated with the incident that received about 579,984 USDT. The firm said the address became active on Sept. 15 and that the stolen funds involved multiple blockchain networks before being consolidated and transferred through several addresses and services.
SlowMist’s investigation found that portions of the funds were transferred toward services including FixedFloat, KuCoin and cce.cash, while other funds were dispersed through additional addresses that the firm continued to trace.
SlowMist urges affected users to move assets to a new wallet
For users who installed FomoPeek versions 1.1 or 1.2, SlowMist recommended treating potentially exposed wallet credentials as compromised, creating a new wallet on an unaffected device and moving assets to it.
“If an attacker has already successfully exploited the device and copied sensitive data off the device, enabling Lockdown Mode or uninstalling the malicious application afterwards cannot retrieve that data,” SlowMist said.
Cointelegraph reached out to Apple and OKX for comment but did not receive a response before publication.
Helen Partz contributed reporting.
Related: Hugging Face hack exposes the open-weight AI cybersecurity paradox
