TREE NEWS reports: SlowMist said a Solana, Ethereum and TRON wallet-monitoring app called FomoPeek carried malicious apptrace and libapptracecore modules in versions 1.1 and 1.2, added on Sept. 9 and Sept. 12, 2026, after its Aug. 29 launch. The modules could reach a remote control server, attempt kernel exploits and sandbox escapes, decrypt Keychain data and harvest 19 wallets including MetaMask, OKX Wallet, Trust Wallet, imToken, TokenPocket and TronLink. One attacker address took in 579,984.34 USDT from Sept. 15.
SlowMist: FomoPeek App Store Tracker Hid iOS Exploit to Steal Wallet Keys
This is a supply-chain attack disguised as a legitimate wallet-tracking utility, and it matters because it targets the exact audience most likely to hold keys on a phone: multi-chain retail users. The presence of kernel exploits and sandbox escapes suggests a capability level well beyond typical App Store malware, raising questions about how the malicious modules cleared review in versions added after launch. The open question is whether other apps share the same infrastructure or developer, and how the compromised wallets' funds continue to move.
Generated by AI for reference only.
Share on WeChat
Open WeChat → Scan → then tap "…" to send to a chat or Moments.
Tap "…" in the top-right corner to send to a chat or share to Moments.