Security firm SlowMist and the OKX security team have uncovered an application named FomoPeek on the Apple App Store that secretly carried a malicious payload. The malicious app drained $579,984 in USDT from users by breaching the deepest defense layers of Apple mobile devices.
FomoPeek exploited an iOS kernel vulnerability to escape the system’s sandbox environment - Apple’s built-in restriction that limits access between applications. Once free from sandbox isolation, FomoPeek immediately targeted sensitive data in the Keychain and accessed files belonging to other crypto wallet apps installed on the victim’s device.
Eight Cross-Version Attack Methods
The scale of the attack involved well-prepared code. Security researchers discovered that FomoPeek’s exploit framework contained eight different attack methods. The attackers embedded compatibility to infect devices running older operating systems ranging from iOS 12.0 to iOS 18.7.2.
FomoPeek also included exploit framework support for operating systems ranging from iOS 26.0 to 26.1. The combination of attack methods ensured that the crypto-stealing code executed breaches regardless of the operating system version used by the victim.
Laundering Funds Prior to Update
The malicious version of FomoPeek was identified in the September 9 App Store release and continued through the September 12 release. The crypto-draining component was only quietly removed with the rollout of version 1.3 update on September 17.
Between these release dates, the primary hacker address moved the stolen proceeds on September 15. Hundreds of thousands of dollars were distributed across multiple blockchain networks to break on-chain tracking trails. The perpetrators then laundered the accumulated USDT through the intermediary platform FixedFloat, the KuCoin exchange, and the cce.cash service.
FomoPeek’s entry into the official Apple App Store serves as a reminder to users that seemingly ordinary apps can still carry kernel-level exploits to steal crypto assets.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
