FomoPeek (Bundle ID com.fomopeek.app, Apple App ID 6806199011) launched on the Apple App Store on 2026-09-07 as a legitimate-looking whale-wallet tracker for Solana, Ethereum, and TRON, published under the developer display name "WhaleScanv" with Porter Manufacturing, L.L.C. as the registered seller of record - an account with no prior App Store history, consistent with a single-use "burner" publisher setup. Versions 1.1 (released 2026-09-09) and 1.2 (released 2026-09-12) added two modules unrelated to the app's advertised whale-tracking function: apptrace and libapptracecore. Together these modules implement a professional iOS kernel exploitation framework offering eight distinct exploit schemes; the malware automatically selects which scheme to run based on the target device model and installed iOS version, covering iOS 12.0-18.7 and 26.0-26.1, with older builds facing elevated exposure.

Once a scheme succeeds, the framework escapes the standard per-app sandbox isolation boundary, then reads and decrypts the on-device system Keychain database - the store Apple uses for passwords, Wi-Fi credentials, certificates, and private keys - and reads data files belonging to other installed applications. Confirmed exfiltration targets included cryptocurrency wallet application data (private keys, mnemonic/seed phrases), stored login credentials, chat records, and other user files; testing by investigators demonstrated the chain could also capture and upload the on-device Apple Notes database, and the malware separately monitored the system clipboard to intercept credentials and seed phrases copied out of wallet apps.

Command and control was split across two channels. First, the app retrieved an encrypted C2 address from a Bitbucket-hosted repository at runtime and decrypted it locally - a dead-drop-resolver pattern that lets the malware's true C2 endpoint hide behind ordinary-looking traffic to a legitimate developer platform. Second, using the address obtained this way, the app connected to infrastructure at api-a95f0ed200f.assisaint.com (with a related subdomain, bp-a95010ced.assisaint.com, secured by a 90-day TrustAsia certificate) to report device information and receive remote configuration and attack commands; the parent domain assisaint.com was registered on 2026-09-12 - the same day v1.2 shipped - through Cloudflare, which also proxy-masked the origin server. Investigators observed the malicious traffic executing on a recurring, automated schedule, indicating the attack functions were live and operating against real users rather than dormant or test code.

Distribution leaned on crypto KOLs, communities, and invite/referral codes, with new users required to register with a referral code, set a "security code," add real wallets for monitoring, and run the app on a physical device for several minutes before qualifying for a 5-7 USDT reward - a gate that both drove organic growth and plausibly filtered out emulator/automated-review environments before the malicious payload engaged. The first public report of asset theft came from X user 金灰 (@GXingPing), who posted at approximately 17:11 UTC on 2026-09-16 that they had lost funds after using FomoPeek and urged others to uninstall it - three days ahead of the formal vendor disclosure. SlowMist, working jointly with OKX's security team, published a public threat-intelligence report and asset-theft warning on 2026-09-19; Binance Wallet and Gate.io issued their own user-facing advisories the same day referencing SlowMist's findings, with Gate.io stating its background risk-control systems had prevented losses for its own users. SlowMist's MistTrack on-chain tracing identified an attacker-controlled address that received a total of 579,984.34 USDT (activity beginning 2026-09-15), with funds spanning Ethereum and BNB Chain (reporting varies on the third chain involved, naming either TRON or Arbitrum) and routed through cross-chain swap/bridge services - including OKX DEX, Meson.fi, Relay.link, Mayan Finance, and FixedFloat - to consolidate on Ethereum. The developer shipped version 1.3 on 2026-09-17, removing both malicious modules outright (the IPA shrank from 10.47MB to 1.81MB); Apple removed FomoPeek from the App Store on 2026-09-20, and DNS delegation for the app's own fomopeek.com domain (registered 2026-08-28 via nameservers ns1/ns2.jtdnsv1.com, AS140227, Hong Kong) went dead the same day. On 2026-09-20, SlowMist founder Cos separately warned that ComeCome, an iOS food-delivery app at comecome.icu, was suspected of embedding a malicious SDK using an attack methodology similar to FomoPeek's - no shared infrastructure has been confirmed, but the near-simultaneous discovery indicates a broader pattern of App Store poisoning targeting crypto-adjacent iOS apps, with Cos also flagging potential risk extending to iPad and Mac devices. No CVE has been assigned and no threat-actor attribution has been publicly disclosed; the campaign's exclusive focus on wallet credential theft indicates financial motivation.