Apple’s App Store is supposed to be the safe option. That’s the pitch, anyway. So when a malicious iOS app called FomoPeek quietly slipped through the review process, exploited multiple kernel-level vulnerabilities, and helped drain nearly $580,000 in crypto from real users, it raised a question worth sitting with: what exactly is that review process protecting us from?
According to Cointelegraph, blockchain security firm SlowMist published an investigation linking FomoPeek to the theft after receiving reports from users who had lost funds and had previously installed the app. Two specific versions, released on September 9 and September 12, contained the malicious code. A third version released September 17 removed it, which means Apple’s detection systems either caught it late or didn’t flag it at all.
What the app actually did is alarming. SlowMist found it contained an exploit framework with eight attack methods, supporting iOS versions from 12.0 all the way through 18.7.2 and even 26.0 to 26.1. When the app launched, the framework loaded automatically. A remote server could then switch on its exploitation and data collection functions without any further interaction from the user. No phishing link. No malicious webpage. Just opening the app was enough.
The framework was built to break out of Apple’s sandbox, the security boundary meant to keep apps isolated from each other. Once past it, FomoPeek could access Keychain data and files belonging to other apps on the same device. SlowMist confirmed it verified this capability in a controlled environment, including access to Apple Notes data. The firm was careful to note that it could not confirm a private key or seed phrase was extracted from every targeted wallet, but the list of named targets is worth knowing:
- MetaMask
- Trust Wallet
- SafePal
- OKX Wallet
- Apple Notes
SlowMist’s onchain analysis pointed to a primary address that received around 579,984 USDT. That address went active on September 15, and the funds moved across multiple blockchain networks before being consolidated and routed through services including FixedFloat, KuCoin, and cce.cash. The investigation, conducted alongside OKX’s security team, was still tracing additional addresses at the time of reporting.
For anyone who installed versions 1.1 or 1.2 of FomoPeek, the advice from SlowMist is blunt: assume your wallet credentials are compromised. Create a new wallet on a clean, unaffected device and move your assets immediately. Uninstalling the app after the fact changes nothing. As SlowMist put it directly, if an attacker already copied sensitive data off the device, no amount of cleanup on your end retrieves it.
This incident fits a pattern that should concern anyone in the crypto space. Attackers are increasingly targeting the apps and devices users trust most, not just web interfaces or phishing pages. And when malware can bypass Apple’s review, hide behind a legitimate-looking app, and silently arm itself through a remote server, the standard advice of “stick to official app stores” starts sounding hollow.