Downloaded from the App Store, and still lost your coins? The full story of the FomoPeek poisoning incident

Original author: ChandlerZ, Foresight News

On September 20, blockchain security firm SlowMist released a FomoPeek analysis report, disclosing that an on-chain monitoring tool called FomoPeek, available on the App Store, had embedded two malicious modules, apptrace and libapptracecore, in FomoPeek 1.1 and 1.2, with capabilities including remote configuration, kernel exploit, sandbox escape, Keychain decryption, and cross-application data collection.

The framework's code even declares a system version coverage range spanning iOS 12.0–18.7.2 and iOS 26.0–26.1, indicating that its attack targets are not limited to older systems or legacy devices.

The investigation began with reports from multiple users whose assets were stolen, involving private key leakage; some of these users had used the two affected versions before the theft occurred.

The investigation states that, based on publicly available information, FomoPeek has all the appearances of a legitimate project:

Public project information App name FomoPeek – Whale Tracker & Smart AlertsApp Store ID6806199011 First release 2026/8/29 Developer display name WhaleScanvSeller / Legal entity Porter Manufacturing, L.L.C.Official website fomopeek[.]com Official X@FomoPeek Positioning Solana / Ethereum / TRON wallet monitoring, Whale Tracking, on-chain alerts System requirements iOS 16.0+ Price / Category Free / Finance Current version 1.3 (updated 2026-09-18)

The app is listed normally on the App Store, has an official website and official social accounts, and whether from the review side or the user side, it is very difficult to link it to a kernel exploit based on appearance alone.

According to the report, FomoPeek targets crypto users who want to track whale transactions and supports monitoring wallet activity on Solana, Ethereum, and TRON. Users add public wallet addresses to receive on-chain alerts, and the app claims to be read-only, not connect to wallets, and not require seed phrases. However, in SlowMist's isolated testing, the program obtained a collection list containing 19 wallets and note-taking apps, and packaged and uploaded Apple Notes data.

Downloaded from the official store, malicious code entered phones through version updates

According to promotional materials compiled by SlowMist, FomoPeek attracted users through crypto KOLs, communities, and invitation codes. After participants downloaded and registered, set a security code, and added monitoring wallets, they needed to operate on a real iPhone for 5 to 7 minutes, and could receive 5 to 7 USDT after review. Some promotions limited participation to one time per phone and did not accept cloud phones.

For people already accustomed to using block explorers and whale-tracking tools, adding a public address is a common operation. A wallet address can display assets and transaction activity, but it cannot be used to sign transfers; the promotion also did not require participants to pre-fund, hand over seed phrases, or approve transactions, so users could easily keep their risk assessment focused only on whether they had given up control of their assets.

Historical installation packages obtained by SlowMist show that the malicious modules were not found in version 1.0, first released on August 29; version 1.1, released on September 9, added the relevant code for the first time; and version 1.2, released on September 12, continued to use it. On September 16, warnings appeared on social platforms from users saying their assets were stolen after downloading the app; version 1.3, released on September 17, removed the two modules, and the installation package size dropped from 10.47MB to 1.81MB.

The main program and the two malicious modules use the same Apple developer signing identity, and the original installation package also retained the encrypted metadata used for App Store distribution. Based on this, the research team confirmed that the malicious modules were already included in the official versions submitted by the developer. Even if users did not install enterprise-signed software or download through third-party websites, they could still receive these two affected versions.

The report also found that the store privacy label stated that no data was collected, while the app's own privacy policy listed information such as device identifiers, push tokens, email addresses, password hashes, and wallet addresses added by users. For ordinary users, merely looking at the store page, official website, and social accounts makes it difficult to discover attack code later added into the installation package.

From device reconnaissance to data exfiltration, how do wallets become targets?

Apple uses sandboxing to limit the files third-party apps can access, and each app has its own data directory. The system keychain provides controlled storage for passwords, keys, and login tokens, with the system checking which apps have permission to read them. Under normal permissions, an app that monitors public on-chain transactions should not be able to directly browse private data stored by another wallet.

The two modules implanted in FomoPeek have different roles: apptrace is responsible for contacting the attacker's command-and-control server, while libapptracecore contains exploit and data collection code. They are loaded when the app starts, and the hidden code can remain in the same app process while the user views normal business interfaces.

During testing, researchers captured a list containing 135 app identifiers. Through this information, the server can determine which wallets are installed on the phone and then issue collection targets to that device, without requiring the user to select or enter wallet names in the interface.

The server also controls whether to launch the exploit, whether to execute repeatedly, and the execution interval. The address used to connect to the server can also be changed remotely, so attackers can adjust targets and operating schedules without republishing the app for each change. The version number and normal functions seen by users can remain unchanged, while the commands received in the background can differ.

According to the attack design reconstructed by SlowMist, the framework then selects an exploitation method based on system version and device model, attempting to obtain kernel-level access beyond ordinary app permissions. The kernel is responsible for system resource and permission management. Once the relevant vulnerability is successfully exploited, malicious programs may bypass existing access restrictions, read other apps' directories, and attempt to extract and decrypt sensitive information in the keychain.

The code contains 8 built-in exploitation strategies, with declared compatibility covering iOS 12.0 to 18.7.2 and 26.0 to 26.1.

During isolated testing, the exploit switch initially returned by the server was off. After researchers manually enabled the relevant switch, the client obtained collection configurations for 19 wallets and note-taking apps, including MetaMask, OKX Wallet, Trust Wallet, imToken, TokenPocket, and TronLink. The configurations pointed to these apps' key storage, databases, and local files, and also included the entire Apple Notes data directory.

Subsequently, the team captured an uploaded compressed package of about 46KB, which when unpacked revealed the Notes database and related files. The data being read is first temporarily stored in FomoPeek's own directory and then sent to a remote server. Notes can therefore also become a source of wallet leakage: if users copy seed phrases into notes, attackers only need to obtain this backup to have an opportunity to restore the corresponding wallet.

For ordinary self-custodial wallets controlled by seed phrases and private keys, whoever obtains usable keys can restore the account on their own device and sign transactions. Transfer instructions are issued by the attacker, and the wallet on the original phone no longer needs to pop up a confirmation window. Even if users did not actively enter seed phrases into FomoPeek, they may still lose assets because data on the same device was read.

According to analysis in the report of a major attacker address by MistTrack, a tracking tool under SlowMist, the address has been active since September 15 and had accumulated 579,984.34 USDT in revenue as of the report's publication. The funds involved Ethereum, BNB Chain, and Arbitrum, with most gathered on Ethereum and then transferred out in batches. One downstream address received 159,000 USDT, all of which was transferred to the exchange platform FixedFloat, while another address's 47,028 USDT flowed to the exchanges KuCoin and FixedFloat respectively.

Backups in photo albums and notes may also be used to restore wallets

FomoPeek simultaneously listed wallets and notes as collection targets, exposing plaintext backups together with wallets' own data files to attack targets. Even if the same person uses several different wallets to diversify asset management, as long as they are installed on the same affected device, or seed phrases are stored together in the same note-taking app, there is still a risk of them being read at the same time.

In February 2025, Kaspersky disclosed a data-stealing program called SparkCat, finding that food delivery, messaging, and other apps with malicious components had entered the App Store and Google Play, including the food delivery app ComeCome. The app used normal business requests to obtain photo album permissions, and after approval scanned accessible images, used text recognition to find seed phrases, and then uploaded the matching images.

SparkCat relied on photo album access permissions to find plaintext backups, while FomoPeek included exploit code attempting to break through system isolation. The former can turn a seed phrase screenshot into an entry point for coin theft, while the latter further brings data saved by other apps into its collection targets. Whether a wallet interface looks legitimate and whether a user has clicked suspicious approvals cannot, on their own, rule out these two types of leakage.

Hardware wallets also need to protect seed phrase backups properly. Ledger's security guidance requires that recovery phrases not be photographed and not be entered into a computer or phone. Even if transaction signing was originally completed on a hardware device, a complete recovery phrase left in a phone's photo album or notes may still be used by others to rebuild the wallet.

If you have installed an affected version, how should you handle assets and devices?

SlowMist recommends that users who have used FomoPeek 1.1 or 1.2 stop running the app, not reinstall it, and treat the related seed phrases, private keys, and sensitive credentials as compromised. The removal of the modules in 1.3 only means that this version no longer carries the described code; it cannot recall data that may already have been uploaded previously.

Asset migration should be performed on a device that has never installed FomoPeek, has an updated system, and comes from a trusted source, and the new wallet must generate an entirely new seed phrase. Importing an old seed phrase into another wallet still restores the original account; adding a new account under the same set of seed phrases also remains controlled by that set of seed phrases. Tokens on each chain, NFTs, and assets still in protocols need to be checked separately to avoid migrating only the most obvious balance shown in the interface.

A wallet's unlock password is usually only used to protect local access; changing it will not replace the on-chain private key. Revoking token approvals can cancel a contract's spending permission, but it cannot stop someone who already has the private key from signing new transactions. For keys that may have leaked, handling should include moving assets out and ceasing use of the old account.

If, during migration, newly added gas fees are immediately transferred away, you should stop repeatedly topping up. The compromised wallet may be monitored by an automated sweeper program, and any tokens deposited to pay gas fees will also be taken by the attacker. At this point, you should contact the wallet's official support or a trusted security team to assess next steps, and avoid handing seed phrases to strangers for help.

Email, trading platforms, and other important accounts on the device also need their login records and unfamiliar sessions checked, with relevant passwords changed on a secure device, suspicious logins signed out, and two-factor authentication enabled. If the Apple or Google login accounts associated with the wallet are also at risk of leakage, they should be handled as well, and suspicious accounts must not continue to serve as recovery entry points for the new wallet.

Before handling the phone, first save the app version, installation time, abnormal transaction hashes, and related screenshots; users who have already suffered coin theft should confirm forensic requirements with official customer service or a security team before deciding whether to wipe and reinstall the device. The device should install the latest security update it supports, but updating the system will not invalidate keys that have already leaked.

For daily reward claims and testing new apps, devices can be kept separate from those used to manage main assets. Phones used to manage assets should have fewer unrelated apps installed, and seed phrases should be kept from remaining in plaintext in photo albums, notes, and chat histories. Read-only monitoring functions can use public addresses, while devices holding signing keys should reduce exposure to software that has not been sufficiently understood.