Press Enter to search · ESC to close

Crypto DeFi

SlowMist: FomoPeek App Store Tracker Hid iOS Exploit to Steal Wallet Keys

SlowMist said a Solana, Ethereum and TRON wallet-monitoring app called FomoPeek carried malicious apptrace and libapptracecore modules in versions 1.1 and 1.2, added on Sept. 9 and Sept. 12, 2026, after its Aug. 29 launch. The modules could reach a remote control server, attempt kernel exploits and sandbox escapes, decrypt Keychain data and harvest 19 wallets including MetaMask, OKX Wallet, Trust Wallet, imToken, TokenPocket and TronLink. One attacker address took in 579,984.34 USDT from Sept. 15.

Original source

AI take

This is a supply-chain attack disguised as a legitimate wallet-tracking utility, and it matters because it targets the exact audience most likely to hold keys on a phone: multi-chain retail users. The presence of kernel exploits and sandbox escapes suggests a capability level well beyond typical App Store malware, raising questions about how the malicious modules cleared review in versions added after launch. The open question is whether other apps share the same infrastructure or developer, and how the compromised wallets' funds continue to move.

Generated by AI for reference only.

Share

Related News

TREE NEWS share card
Long-press image above → Save to Photos / Share
Pitch us Feedback