SlowMist: FomoPeek Versions 1.1–1.2 Contain Malicious Code, May Result in Leakage of Private Keys and Mnemonics

SlowMist, a prominent blockchain security firm, has issued a security alert, revealing it has recently received multiple reports of FomoPeek users’ crypto assets being stolen. Following a joint investigation with OKX’s security team, the firm found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contain malicious code. SlowMist noted that FomoPeek includes modules unrelated to its legitimate operations, one of which is a kernel exploit framework targeting iOS, supporting 8 distinct attack vectors that automatically select exploitation methods based on the device model and iOS version. Affected iOS versions span 12.0 to 18.7, and 26.0 to 26.1. If the exploit is successful, the app can break out of the iOS sandbox, access and decrypt Keychain data, leading to leaks of private keys, mnemonic phrases, login credentials, and other sensitive files. Additionally, FomoPeek connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist added that analysis of captured plaintext traffic shows the malicious attack functions are currently active and run automatically on a regular basis. The firm advised users who have installed or used FomoPeek versions 1.1 to 1.2 to immediately check their assets for anomalies, generate new private keys and mnemonic phrases on a trusted device that never had the app installed, transfer their assets to a new account promptly, upgrade iOS to the latest version, and avoid continuing to use or reinstalling FomoPeek.