Written by: SlowMist, a blockchain security company
Translated by: Gandalf, Techub News
We have recently received multiple reports of user assets being stolen. Investigations revealed that the affected cases all involved private key leaks, and some users had installed and used versions 1.1 to 1.2 of the @FomoPeek App.
The joint investigation by @SlowMist_Team and the @okx security team confirmed that the application contains malicious code.
In addition to normal functions, FomoPeek also includes two modules unrelated to its claimed business functions. One of these modules contains an #iOS kernel exploitation framework, which has eight different exploitation methods and can automatically select the attack method based on device model and iOS version.
Affected iOS versions include: iOS 12.0–18.7 and iOS 26.0–26.1.
If the exploitation is successful, the application may escape the iOS sandbox, access, and decrypt keychain data, as well as read files from other applications on the device.
This means that sensitive data stored on the device may be leaked, including private keys, mnemonic phrases, login credentials, chat records, and files.
The application also connects to hidden servers unrelated to its public service and can receive remote commands.
According to plaintext traffic captured during our analysis, its attack functions are currently enabled and will run automatically on a regular basis. Generally, devices running older iOS versions are at higher risk.
If you have installed or used versions 1.1 to 1.2 of FomoPeek, we recommend that you take the following actions immediately:
1. Check your accounts and assets for any unusual activity.
2. Create a new account and generate new private keys and mnemonic phrases on a trusted device that has never had FomoPeek installed.
3. Transfer your assets to the new account as soon as possible.
4. Update your device to the latest available iOS version.
5. Do not continue to use or reinstall FomoPeek.
6. If you notice any suspicious asset activity, please contact the official support team of the relevant platform and retain the affected device and relevant evidence for further investigation.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
