Apple's App Store "FomoPeek" proved peek-and-steak: $580K drained via silent iOS exploits 🍎

A malicious iOS application distributed through Apple's App Store has been tied to the theft of approximately $580,000 in cryptocurrency, according to an investigation by blockchain security firm SlowMist. The app, named FomoPeek, contained two malicious modules capable of exploiting iOS kernel vulnerabilities, escaping Apple's sandbox protections and accessing Keychain credentials and files belonging to other applications.

SlowMist said the compromised versions of FomoPeek were released on Sept. 9 and Sept. 12, while version 1.3, published on Sept. 17, removed the malicious components. The exploit framework embedded in the app included eight attack methods and declared support for iOS versions ranging from 12.0 to 18.7.2 and 26.0 to 26.1. SlowMist conducted the investigation alongside the OKX security team after receiving user reports of asset theft linked to prior installations of the affected FomoPeek builds.

SlowMist's onchain analysis identified a primary hacker address associated with the incident that received about 579,984 USDT. The firm said the address became active on Sept. 15 and that the stolen funds traversed multiple blockchain networks before being consolidated and routed through several intermediary addresses and services. Portions of the funds were transferred toward services including FixedFloat, KuCoin and cce.cash, while additional funds were dispersed through other addresses that SlowMist said it continued to trace.

The investigation found that the attack flow relied on privilege escalation to access sensitive wallet data stored in the iOS Keychain, with the malicious modules designed to operate covertly within the App Store distribution environment. SlowMist did not disclose the total number of affected users but said the stolen assets had been consolidated through a structured laundering path spanning multiple chains and platforms.

Cointelegraph reached out to Apple, SlowMist and OKX for comment but did not receive a response before publication. SlowMist said users who installed the affected FomoPeek versions should consider their devices potentially compromised and review any crypto wallet credentials stored on those devices.