Malicious iOS App Weaponizes Kernel Exploits to Drain Crypto Wallets
TREE NEWS reports: A joint investigation by SlowMist and OKX’s security team has confirmed that versions 1.1 through 1.2 of the FomoPeek app contain malicious code capable of stealing private keys, seed phrases, login credentials, and chat records from infected iOS devices. The app embeds a kernel exploit framework with eight distinct attack methods, automatically selecting the appropriate path based on device model and iOS version.
Once successful, the exploit escapes the iOS sandbox, decrypts Keychain data, and reads files from other applications. Affected iOS versions span 12.0–18.7 and 26.0–26.1. Critically, the attack functionality is currently active and runs automatically on a periodic basis, meaning victims may be compromised without any user interaction.
Why This Attack Matters
This is not a garden-variety phishing app. Kernel-level exploitation on iOS is rare and technically demanding, suggesting a well-resourced attacker. The ability to decrypt the Keychain — Apple’s encrypted credential store — means the malware can harvest not just crypto wallets but also banking apps, exchange logins, and messaging history. For crypto users, the implications are severe: seed phrases and private keys stored in wallet apps become directly accessible to the attacker.
The collaboration between SlowMist, a leading blockchain security firm, and OKX, one of the largest exchanges, reflects a growing trend of public-private threat intelligence sharing in the crypto industry. Exchange security teams have strong incentives to identify such threats early, as compromised users often represent future withdrawal and deposit risks.
Recommended Remediation Steps
- Check accounts and assets for any unusual activity
- Create new accounts and generate fresh private keys/seed phrases on a trusted device that never had FomoPeek installed
- Transfer assets to the new accounts as soon as possible
- Update the device to the latest iOS version
- Stop using and uninstall FomoPeek immediately
Broader Implications for Crypto Security
Mobile wallets have become the primary interface for retail crypto users, yet mobile operating system security remains an underappreciated attack surface. While much industry attention focuses on smart contract audits and DeFi protocol exploits, endpoint compromise represents a fundamentally different threat model — one that bypasses on-chain security entirely.
The use of kernel exploits also raises questions about the provenance of such code. Sophisticated iOS kernel exploits are typically the domain of nation-state actors or commercial surveillance vendors, and their appearance in a consumer-facing crypto app suggests either leaked tooling or a significant escalation in criminal capabilities.
Looking ahead, users should expect continued targeting of mobile endpoints as crypto holdings grow. Hardware wallets, air-gapped signing, and multi-signature setups remain the most robust defenses against this class of attack. The incident also underscores the value of cross-industry security collaboration — a model likely to expand as threats grow more sophisticated.
