SlowMist and OKX Security Team Analyze FomoPeek App Store Poisoning and iOS Kernel Exploitation

The SlowMist security team, in collaboration with the OKX security team, identified malicious modules in FomoPeek iOS app versions 1.1 and 1.2 that led to private key theft. These versions contained embedded modules capable of kernel exploitation, sandbox escape, and Keychain decryption. Analysis confirmed the app communicated with a remote C2 server to retrieve configurations and target specific wallet and note-taking applications for data exfiltration. The malicious code was introduced on September 9, 2026, and removed in version 1.3 released on September 17.