Malicious Code Found in Official App Store Builds of FomoPeek
TREE NEWS reports: Security researchers at SlowMist, working alongside the security teams of OKX and OKX Wallet, have confirmed that versions 1.1 and 1.2 of the FomoPeek iOS application — released on September 9 and September 12 respectively — contained embedded malicious modules. These modules, identified as apptrace and liba, were capable of exploiting iOS kernel vulnerabilities to exfiltrate sensitive user data from affected devices.
The discovery marks a rare instance of malicious code passing Apple’s App Store review process at scale, raising uncomfortable questions about mobile supply chain security in the crypto sector, where apps routinely handle private keys, seed phrases, and wallet credentials.
How the Attack Chain Worked
The malicious components were not merely surveillance SDKs. The liba module reportedly leveraged a kernel-level exploit to escalate privileges, bypassing iOS sandbox protections. This would allow an attacker to read files, capture keystrokes, or extract credentials from other applications — including crypto wallets — installed on the same device.
- Version 1.1 (Sept 9): First appearance of the
apptracemodule - Version 1.2 (Sept 12): Expanded payload with the
libakernel exploit - Detection: Flagged through collaborative threat intelligence between SlowMist and OKX security teams
The use of a kernel exploit inside a publicly distributed App Store binary is significant. Historically, such exploits have been the domain of nation-state actors and sophisticated jailbreak tools. Their appearance in a consumer crypto app suggests either a compromised developer pipeline or deliberate insider insertion.
Implications for Crypto Mobile Security
This incident underscores a structural weakness in how crypto users assess risk. Users have been trained to scrutinize smart contracts, audit reports, and on-chain activity — but rarely the binary they install from an official app store. The assumption that Apple’s review process provides a security guarantee has now been demonstrably challenged.
For wallet providers, the event reinforces the case for hardware-backed key storage, passkeys, and secure enclaves that isolate signing operations from the broader OS. For exchanges and custodians, it highlights the need for continuous mobile threat monitoring rather than one-time audits.
What Comes Next
Affected users should assume credential compromise and rotate any secrets stored on devices that ran FomoPeek 1.1 or 1.2. The broader industry should expect increased scrutiny of third-party SDKs and analytics libraries embedded in crypto apps, which remain the most common vector for supply chain attacks.
The episode also strengthens the argument for reproducible builds and open-source mobile clients in crypto — a standard that remains the exception rather than the rule. Until that changes, the gap between on-chain transparency and off-chain opacity will remain one of the sector’s most exploited weaknesses.
