🚨 SlowMist TI Alert: FomoPeek App v1.1–1.2 Asset Theft 🚨 We have recently received multiple reports of users having assets stolen. Our investigation found that the affected cases involved private key exposure, and some of the users had previously installed and used @FomoPeek App versions 1.1–1.2. A joint investigation by the @SlowMist_Team and @okx security teams confirmed that the app contains malicious code.⚠️ Besides its normal features, FomoPeek includes two modules that are unrelated to its stated business functions. One of them contains an #iOS kernel exploitation framework with eight different exploit methods. The framework can automatically choose an attack method based on the device model and iOS version. ‼️Affected iOS versions: iOS 12.0–18.7 and iOS 26.0–26.1.‼️ If the exploit succeeds, the app may escape the iOS sandbox, access and decrypt Keychain data, and read files belonging to other apps on the device. 🔐 This means sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, and files, may be exposed. The app also connects to hidden servers that are unrelated to its public-facing services and can receive remote commands. Based on plaintext traffic captured during our analysis, the attack functionality is currently enabled and runs automatically at regular intervals. In general, devices running older iOS versions are at higher risk. If you have installed or used FomoPeek versions 1.1–1.2, we recommend that you take action immediately: 1️⃣ Check your accounts and assets for any unusual activity. 2️⃣ On a trusted device where FomoPeek has never been installed, create a new account and generate a new private key and seed phrase. 3️⃣ Move your assets to the new account as soon as possible. 4️⃣ Update your device to the latest available iOS version. 5️⃣ Do not continue using or reinstalling FomoPeek. 6️⃣ If you notice any suspicious asset activity, contact the official support team of the relevant platform and keep the affected device and related evidence for further investigation.

⚠️最近一些 iPhone 用户的钱包被盗，是因为安装了 FomoPeek 这个 App，v1.1-1.2 主要版本引入了恶意 SDK，其包含一套专业的 iOS 内核攻击框架，集成 8 种漏洞利用方案，可根据设备型号及系统版本自动选择攻击方式，已知受影响 iOS 版本：iOS 12.0–18.7、26.0–26.1。 攻击成功后，该 App 可突破 iOS 沙盒隔离机制，进而读取并解密系统钥匙串（Keychain），并访问设备上其他 App 的数据文件。用户存储在设备中的私钥、助记词、登录凭据、聊天记录及文件等，均可能因此面临泄露风险。此外，该 App 还会连接与公开业务无关的隐蔽服务器，接收远程指令。 ⚠️⚠️⚠️这里重点做个提醒，由于该手法已经开始泛滥，iPhone 千万不要下载不明 App。 并保持 iPhone 及时更新到最新版本，比如现在是 27（不代表以后不会有风险，攻防对抗永远在升级）。 具体细节见我们的推文👇