Written by: SlowMist, a blockchain security company
Translated by: Gandalf, Techub News
We have recently received multiple reports of user assets being stolen. Investigations revealed that the affected cases all involved private key leaks, and some users had installed and used versions 1.1 to 1.2 of the @FomoPeek App.
The joint investigation by @SlowMist_Team and the @okx security team confirmed that the application contains malicious code.
In addition to normal functions, FomoPeek also includes two modules unrelated to its claimed business functions. One of these modules contains an #iOS kernel exploitation framework, which has eight different exploitation methods and can automatically select the attack method based on device model and iOS version.
Affected iOS versions include: iOS 12.0–18.7 and iOS 26.0–26.1.
If the exploitation is successful, the application may escape the iOS sandbox, access, and decrypt keychain data, as well as read files from other applications on the device.
This means that sensitive data stored on the device may be leaked, including private keys, mnemonic phrases, login credentials, chat records, and files.
The application also connects to hidden servers unrelated to its public service and can receive remote commands.
According to plaintext traffic captured during our analysis, its attack functions are currently enabled and will run automatically on a regular basis. Generally, devices running older iOS versions are at higher risk.
If you have installed or used versions 1.1 to 1.2 of FomoPeek, we recommend that you take the following actions immediately:
1. Check your accounts and assets for any unusual activity.
2. Create a new account and generate new private keys and mnemonic phrases on a trusted device that has never had FomoPeek installed.
3. Transfer your assets to the new account as soon as possible.
4. Update your device to the latest available iOS version.
5. Do not continue to use or reinstall FomoPeek.
6. If you notice any suspicious asset activity, please contact the official support team of the relevant platform and retain the affected device and relevant evidence for further investigation.
Disclaimer: This article represents only the personal views of the author and does not represent the position and views of this platform. This article is for information sharing only and does not constitute any investment advice to anyone. Any disputes between users and authors are unrelated to this platform. If the articles or images on the webpage involve infringement, please provide relevant proof of rights and identity documents and send an email to support@aicoin.com. The relevant staff of this platform will conduct an investigation.