Skip to navigation

Threat reportMalwareTL-2026-2591

FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryption

criticalACTIVE

FomoPeek, an iOS whale-tracking app distributed on the Apple App Store, shipped versions 1.1-1.2 with two hidden modules (apptrace, libapptracecore) bundling an 8-scheme kernel exploit framework that escapes the iOS sandbox, decrypts the Keychain, and harvests data from other apps.

Key facts for FomoPeek iOS keychain theft

IdentifiersTL-2026-2591
SeverityCRITICAL
Exploitation statusExploited in the wild
Affected productsWhaleScanv (Apple seller of record: Porter Manufacturing, L.L.C.) FomoPeek iOS app (Bundle ID com.fomopeek.app, Apple App ID 6806199011); Apple iOS
Malwareapptrace, libapptracecore
MITRE ATT&CK techniquesT1404 Exploitation for Privilege Escalation, T1409 Stored Application Data, T1414 Clipboard Data, T1418 Software Discovery, T1420 File and Directory Discovery, T1426 System Information Discovery, T1481.001 Dead Drop Resolver, T1481.002 Bidirectional Communication, T1521 Encrypted Channel, T1633 Virtualization/Sandbox Evasion, T1634.001 Keychain, T1646 Exfiltration Over C2 Channel and 1 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency
Target regionsGlobal
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for FomoPeek iOS keychain theft

As of 2026-09-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2591 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bitbucket Dead-Drop C2 Resolver Followed by assisaint.com Beacon

Detects the FomoPeek C2 discovery/beacon chain: an HTTPS request to bitbucket.org (the abused dead-drop resolver hosting an encrypted C2 address) followed within a short window by an outbound connection from the same device to assisaint.com or its api-a95f0ed200f/bp-a95010ced subdomains, or to fomopeek.com app infrastructure.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1481.001, T1481.002, T1521
  • Data sources: zscaler_web_proxy, cisco_umbrella_proxy, palo_alto_threat_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=proxy (sourcetype=zscaler:web OR sourcetype=cisco:umbrella:proxy OR sourcetype=pan:threat)
| eval dest_domain=lower(coalesce(dest_domain, url_domain, dest_hostname))
| eval stage=case(
    match(dest_domain, "bitbucket\.org"), "dead_drop_resolver",
    match(dest_domain, "(^|\.)assisaint\.com$") OR match(dest_domain, "api-a95f0ed200f\.assisaint\.com|bp-a95010ced\.assisaint\.com"), "c2_beacon",
    match(dest_domain, "fomopeek\.com"), "app_infra",
    1=1, null())
| where isnotnull(stage)
| stats count min(_time) as first_seen max(_time) as last_seen values(stage) as stages by src_ip, user, dest_domain
| eventstats dc(stage) as stage_diversity by src_ip
| where stage_diversity >= 2 OR match(dest_domain, "assisaint\.com")
| sort - last_seen

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("assisaint.com", "api-a95f0ed200f.assisaint.com", "bp-a95010ced.assisaint.com", "fomopeek.com")
    or (RemoteUrl has "bitbucket.org" and InitiatingProcessFileName has_any ("fomopeek", "apptrace"))
| extend Stage = case(
    RemoteUrl has "bitbucket.org", "dead_drop_resolver",
    RemoteUrl has "assisaint.com", "c2_beacon",
    RemoteUrl has "fomopeek.com", "app_infrastructure",
    "other")
| where Stage != "other"
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Events = count(), Stages = make_set(Stage) by DeviceId, DeviceName, RemoteUrl
| order by LastSeen desc

Sigma

title: Bitbucket Dead-Drop C2 Resolver Followed by assisaint.com Beacon
id: 7a1e2f3c-4b5d-4e6a-9f8c-1a2b3c4d5e08
status: experimental
description: Detects a device requesting a bitbucket.org repository (FomoPeek's dead-drop resolver hosting an encrypted C2 address) followed by a connection to assisaint.com or its subdomains, the two-stage C2 discovery pattern used to hide the true C2 endpoint behind traffic to a legitimate developer platform.
references:
    - https://slowmist.medium.com/threat-intelligence-analysis-of-fomopeek-app-store-poisoning-and-ios-kernel-exploitation-e568762d11ca
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-20
tags:
    - attack.command-and-control
    - attack.t1481.001
    - attack.t1481.002
    - attack.t1521
logsource:
    category: proxy
detection:
    selection_resolver:
        c-uri|contains: 'bitbucket.org'
    selection_c2:
        cs-host|contains:
            - 'assisaint.com'
            - 'api-a95f0ed200f.assisaint.com'
            - 'bp-a95010ced.assisaint.com'
    timeframe: 15m
    condition: selection_resolver and selection_c2
falsepositives:
    - Legitimate developer workstations that both browse bitbucket.org and separately, coincidentally, resolve an unrelated domain; the paired timeframe and the assisaint.com-specific match make this rare
level: critical

Known false positives:

  • A device that independently browses bitbucket.org for legitimate development work and, unrelated, later resolves a domain that happens to also match the c2_beacon pattern; the assisaint.com-specific match on its own has no known legitimate use

Tuning notes: The stage_diversity>=2 condition is the noise-reduction lever — tighten it to require the bitbucket.org hit specifically precede (not just co-occur with) the assisaint.com hit if the proxy log ordering is reliable; drop the bitbucket.org leg entirely and alert on assisaint.com alone at critical severity since that domain has no legitimate use.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • iOS Devices Exploit-Eligible for the FomoPeek 8-Scheme Kernel Exploit Framework · unlock with TL Creds
  • Clipboard Monitoring & Apple Notes Database Exfiltration Attempt · unlock with TL Creds
  • [indicator] C2 Beaconing on a Newly Registered, TrustAsia-Certificate-Secured Domain · unlock with TL Creds
  • Anti-Emulator Activation Gate Before Malicious Payload Engagement · unlock with TL Creds
  • Cross-App Wallet & Credential File Discovery Sweep (Pre-Theft Enumeration) · unlock with TL Creds
  • Exfiltration Over FomoPeek/[indicator] C2 Channel · unlock with TL Creds
  • FomoPeek Malicious iOS App ([indicator] v1.1/v1.2) in MDM Inventory · unlock with TL Creds
  • iOS Keychain Mass-Decryption Following Kernel Sandbox Escape · unlock with TL Creds

Indicators of compromise for FomoPeek iOS keychain theft

As of 2026-09-20, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2591.

Sample indicators (3 of 17)

  • Domain: fomopeek[.]com
  • Domain: assisaint[.]com
  • Domain: ns1[.]jtdnsv1[.]com

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

How FomoPeek iOS keychain theft works

SlowMist and OKX confirmed live exploitation and real victim asset theft before Apple pulled the app on 2026-09-20.

FomoPeek (Bundle ID com.fomopeek.app, Apple App ID 6806199011) launched on the Apple App Store on 2026-09-07 as a legitimate-looking whale-wallet tracker for Solana, Ethereum, and TRON, published under the developer display name "WhaleScanv" with Porter Manufacturing, L.L.C. as the registered seller of record - an account with no prior App Store history, consistent with a single-use "burner" publisher setup. Versions 1.1 (released 2026-09-09) and 1.2 (released 2026-09-12) added two modules unrelated to the app's advertised whale-tracking function: apptrace and libapptracecore. Together these modules implement a professional iOS kernel exploitation framework offering eight distinct exploit schemes; the malware automatically selects which scheme to run based on the target device model and installed iOS version, covering iOS 12.0-18.7 and 26.0-26.1, with older builds facing elevated exposure.

Once a scheme succeeds, the framework escapes the standard per-app sandbox isolation boundary, then reads and decrypts the on-device system Keychain database - the store Apple uses for passwords, Wi-Fi credentials, certificates, and private keys - and reads data files belonging to other installed applications. Confirmed exfiltration targets included cryptocurrency wallet application data (private keys, mnemonic/seed phrases), stored login credentials, chat records, and other user files; testing by investigators demonstrated the chain could also capture and upload the on-device Apple Notes database, and the malware separately monitored the system clipboard to intercept credentials and seed phrases copied out of wallet apps.

Command and control was split across two channels. First, the app retrieved an encrypted C2 address from a Bitbucket-hosted repository at runtime and decrypted it locally - a dead-drop-resolver pattern that lets the malware's true C2 endpoint hide behind ordinary-looking traffic to a legitimate developer platform. Second, using the address obtained this way, the app connected to infrastructure at api-a95f0ed200f.assisaint.com (with a related subdomain, bp-a95010ced.assisaint.com, secured by a 90-day TrustAsia certificate) to report device information and receive remote configuration and attack commands; the parent domain assisaint.com was registered on 2026-09-12 - the same day v1.2 shipped - through Cloudflare, which also proxy-masked the origin server. Investigators observed the malicious traffic executing on a recurring, automated schedule, indicating the attack functions were live and operating against real users rather than dormant or test code.

Distribution leaned on crypto KOLs, communities, and invite/referral codes, with new users required to register with a referral code, set a "security code," add real wallets for monitoring, and run the app on a physical device for several minutes before qualifying for a 5-7 USDT reward - a gate that both drove organic growth and plausibly filtered out emulator/automated-review environments before the malicious payload engaged. The first public report of asset theft came from X user 金灰 (@GXingPing), who posted at approximately 17:11 UTC on 2026-09-16 that they had lost funds after using FomoPeek and urged others to uninstall it - three days ahead of the formal vendor disclosure. SlowMist, working jointly with OKX's security team, published a public threat-intelligence report and asset-theft warning on 2026-09-19; Binance Wallet and Gate.io issued their own user-facing advisories the same day referencing SlowMist's findings, with Gate.io stating its background risk-control systems had prevented losses for its own users. SlowMist's MistTrack on-chain tracing identified an attacker-controlled address that received a total of 579,984.34 USDT (activity beginning 2026-09-15), with funds spanning Ethereum and BNB Chain (reporting varies on the third chain involved, naming either TRON or Arbitrum) and routed through cross-chain swap/bridge services - including OKX DEX, Meson.fi, Relay.link, Mayan Finance, and FixedFloat - to consolidate on Ethereum. The developer shipped version 1.3 on 2026-09-17, removing both malicious modules outright (the IPA shrank from 10.47MB to 1.81MB); Apple removed FomoPeek from the App Store on 2026-09-20, and DNS delegation for the app's own fomopeek.com domain (registered 2026-08-28 via nameservers ns1/ns2.jtdnsv1.com, AS140227, Hong Kong) went dead the same day. On 2026-09-20, SlowMist founder Cos separately warned that ComeCome, an iOS food-delivery app at comecome.icu, was suspected of embedding a malicious SDK using an attack methodology similar to FomoPeek's - no shared infrastructure has been confirmed, but the near-simultaneous discovery indicates a broader pattern of App Store poisoning targeting crypto-adjacent iOS apps, with Cos also flagging potential risk extending to iPad and Mac devices. No CVE has been assigned and no threat-actor attribution has been publicly disclosed; the campaign's exclusive focus on wallet credential theft indicates financial motivation.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1404 Exploitation for Privilege Escalation

Collection

T1409 Stored Application Data

Credential Access

T1414 Clipboard Data; T1634.001 Keychain

Discovery

T1418 Software Discovery; T1420 File and Directory Discovery; T1426 System Information Discovery

Command and Control

T1481.001 Dead Drop Resolver; T1481.002 Bidirectional Communication; T1521 Encrypted Channel

Defense Evasion

T1633 Virtualization/Sandbox Evasion

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1661 Application Versioning

Remediation for FomoPeek iOS keychain theft

Patches

  • No CVE or Apple security patch has been publicly assigned or issued for the underlying kernel exploit chain as of 2026-09-20; remediation to date is app removal (developer's v1.3 and Apple's App Store takedown), not an OS-level fix

Immediate actions

  • Uninstall FomoPeek (any version, 1.0 through 1.3) from all iOS devices immediately
  • Treat every wallet, exchange, or messaging credential that was ever active, viewed, or stored on a device that ran FomoPeek 1.1/1.2 as compromised
  • Move funds from any wallet whose private key or seed phrase was ever displayed, copied, or stored on an affected device to a newly generated wallet created on a clean device
  • Rotate exchange API keys, 2FA secrets, and Keychain-backed autofill passwords that were accessible on the affected device
  • Review and revoke unexpected token approvals or withdrawal authorizations on wallets that were ever used on the affected device
  • Preserve the affected device and transaction history for forensic review before wiping or reselling it

Workarounds

  • Avoid installing apps from single-app, recently-registered developer accounts on devices that also hold real wallet credentials
  • Disable clipboard access for untrusted apps where the OS permits it, and avoid copy/pasting seed phrases or private keys at all

Longer-term hardening

  • Deploy mobile threat defense (MTD) tooling capable of flagging anomalous native-module loading, unexpected outbound connections, and Keychain access patterns from installed iOS apps
  • Treat unsolicited crypto-tracking/portfolio apps promoted via KOLs, invite codes, or small token rewards as high-risk installs requiring isolated vetting before use on any device holding real wallet credentials
  • Keep wallet credentials on a dedicated device or hardware wallet separate from general-purpose devices that run third-party crypto utilities

Affected and fixed versions

  • WhaleScanv (Apple seller of record: Porter Manufacturing, L.L.C.) — FomoPeek iOS app (Bundle ID com.fomopeek.app, Apple App ID 6806199011)
    Vulnerable versions: 1.1; 1.2
    Fixed in: 1.3
  • Apple — iOS
    Vulnerable versions: 12.0-18.7; 26.0-26.1

Timeline of FomoPeek iOS keychain theft

  • locked-ioc-11 registered, delegated to nameservers ns1/locked-ioc-6 (AS140227, Hong Kong), ahead of the app's public release.
  • FomoPeek published on the Apple App Store (locked-ioc-4, App ID 6806199011) under developer display name locked-ioc-13, seller of record locked-ioc-2, marketed as a Solana/Ethereum/TRON whale-wallet tracker.
  • Version 1.1 published, introducing the hidden locked-ioc-16 and locked-ioc-7 modules bundling the 8-scheme iOS kernel exploit framework.
  • Version 1.2 published, continuing to carry the malicious exploit framework.
  • C2 domain locked-ioc-10 registered via locked-ioc-14 (proxy-masked origin) the same day version 1.2 shipped.
  • X user locked-ioc-8 posts the first public report of cryptocurrency asset theft linked to FomoPeek at approximately 17:11 UTC, three days ahead of the formal vendor disclosure.
  • Version 1.3 released, stripping both malicious modules entirely; IPA size drops from 10.47MB to 1.81MB.
  • locked-ioc-9 and locked-ioc-17 issue user-facing security advisories referencing SlowMist's findings; locked-ioc-17 states its background risk-control systems prevented losses for its own users.
  • SlowMist and OKX jointly publish a threat-intelligence report and asset-theft warning.
  • SlowMist founder Cos publicly warns about ComeCome (locked-ioc-12), an iOS food-delivery app suspected of embedding a malicious SDK using an attack methodology similar to FomoPeek's, and flags potential risk extending to iPad and Mac devices.
  • Apple removes FomoPeek from the App Store; DNS delegation for locked-ioc-11 goes dead the same day.

Sources cited for FomoPeek iOS keychain theft

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats