SlowMist Issues Asset Theft Risk Alert for FomoPeek App Versions 1.1–1.2

Odaily reports that SlowMist has issued an asset theft risk alert regarding FomoPeek App versions 1.1–1.2. Recently, multiple reports of user asset theft have been received. Upon verification, all related incidents involved private key leaks, and some affected users had previously downloaded and used FomoPeek versions 1.1–1.2.

Joint analysis by SlowMist & OKX security teams has confirmed: there is clear evidence that the application was implanted with malicious code. In addition to normal business functions, the app bundles two modules unrelated to its business operations, one of which contains a professional iOS kernel attack framework integrating 8 exploit methods that can automatically select an attack method based on device model and system version (affected iOS versions: iOS 12.0–18.7, 26.0–26.1).

After a successful attack, the app can break through the iOS sandbox isolation mechanism to read and decrypt the system Keychain, and access data files of other apps on the device. Users' private keys, mnemonic phrases, login credentials, chat records, and files stored on the device may all be at risk of exposure. Additionally, the app connects to covert servers unrelated to its public business operations to receive remote commands.

Intercepted plaintext communications show that its attack functionality is currently active and executes automatically on a regular basis. The lower the iOS version running on the device, the higher the potential risk.

If you have ever downloaded or used this app, please immediately: check your account asset and private key security status; create a new account and generate entirely new keys on a secure device confirmed to have never installed this app; transfer assets to the new account as soon as possible; update to the latest iOS version; and do not continue to use or reinstall this app. If you discover any abnormal asset activity, please immediately contact the official customer service of the relevant platform and preserve your device and related evidence for further investigation.