The FomoPeek Attack: How an App Store Download Stole Other Apps’ Data

SlowMist issued a warning on September 19; on the 20th, SlowMist and the OKX security team published a joint analysis. Versions 1.1 and 1.2 of the iOS app FomoPeek carried a malicious module. Multiple users had assets stolen after using it, and roughly $580,000 in USDT has been traced to the primary attack address.

FomoPeek is a whale-watching tool. No one ever typed a seed phrase or private key into it. What it took was what other apps on the same phone had stored.

How it worked

This was not a counterfeit app. Version 1.0, released August 29, was clean; version 1.1 on September 9 added the malicious module; version 1.3 on September 17 removed it. All three went to the App Store through the developer’s own account. Users who never jailbroke their phones and never clicked a phishing link were compromised by downloading and updating normally.

The module carried an iOS kernel exploitation framework covering iOS 12.0 through 18.7.2 and 26.0 through 26.1. A successful exploit gave it kernel privileges, which let it break the sandbox between apps, read the system Keychain and data held by other apps, and ship it to the attacker’s server.

The target list SlowMist obtained named 19 apps, most of them wallets, plus Apple Notes. A seed phrase you never entered into FomoPeek but kept in Notes was just as exposed.

No impact on Safeheron clients

Safeheron is not among the 19 targets SlowMist published. No Safeheron application data is involved, and clients need take no action.

What this incident should tell us

Not jailbreaking, and installing only from the App Store, does not make a phone safe. For any device that holds a wallet or manages assets, we recommend:

• Update iOS promptly so known vulnerabilities get patched.

• Keep asset-management devices dedicated, with as few unrelated apps as possible, especially tools from unfamiliar sources or developers.

• For institutional assets, use distributed key management and multi-party approval, so that one compromised device cannot cost you funds.

How Safeheron reduces this risk

Safeheron uses 3/3 MPC-TSS threshold signatures. The client’s phone holds one key shard; the other two sit in TEEs in separate cloud environments, and a signature requires all three. The complete private key is never assembled at any point in key generation, storage, or signing.

There is therefore no complete private key in the phone’s Keychain to steal. An attacker who takes the shard off the device still cannot produce a signature.

Key shards are one half of it. Transfer authority has to be governed as well. In Safeheron, each enterprise sets who can initiate, who approves, how many approvals a given amount requires, and which whitelisted addresses funds can reach, so its asset-management rules are enforced on every transaction.

Devices get compromised, and an asset-management system has to be built for that. Key sharding and a sound approval policy keep one lost phone from handing an attacker full control of the assets.

To learn how Safeheron builds institutional-grade self-custody on MPC-TSS and TEEs, get in touch.