# FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryption

> FomoPeek, an iOS whale-tracking app distributed on the Apple App Store, shipped versions 1.1-1.2 with two hidden modules (apptrace, libapptracecore) bundling an 8-scheme kernel exploit framework that escapes the iOS sandbox, decrypts the Keychain, and harvests data from other apps. SlowMist and OKX confirmed live exploitation and real victim asset theft before Apple pulled the app on 2026-09-20.

- **Published:** 2026-09-20T00:00:00Z
- **Last reviewed:** 2026-09-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2591
- **ID:** TL-2026-2591
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FomoPeek (Bundle ID com.fomopeek.app, Apple App ID 6806199011) launched on the Apple App Store on 2026-09-07 as a legitimate-looking whale-wallet tracker for Solana, Ethereum, and TRON, published under the developer display name "WhaleScanv" with Porter Manufacturing, L.L.C. as the registered seller of record - an account with no prior App Store history, consistent with a single-use "burner" publisher setup. Versions 1.1 (released 2026-09-09) and 1.2 (released 2026-09-12) added two modules unrelated to the app's advertised whale-tracking function: apptrace and libapptracecore. Together these modules implement a professional iOS kernel exploitation framework offering eight distinct exploit schemes; the malware automatically selects which scheme to run based on the target device model and installed iOS version, covering iOS 12.0-18.7 and 26.0-26.1, with older builds facing elevated exposure.

Once a scheme succeeds, the framework escapes the standard per-app sandbox isolation boundary, then reads and decrypts the on-device system Keychain database - the store Apple uses for passwords, Wi-Fi credentials, certificates, and private keys - and reads data files belonging to other installed applications. Confirmed exfiltration targets included cryptocurrency wallet application data (private keys, mnemonic/seed phrases), stored login credentials, chat records, and other user files; testing by investigators demonstrated the chain could also capture and upload the on-device Apple Notes database, and the malware separately monitored the system clipboard to intercept credentials and seed phrases copied out of wallet apps.

Command and control was split across two channels. First, the app retrieved an encrypted C2 address from a Bitbucket-hosted repository at runtime and decrypted it locally - a dead-drop-resolver pattern that lets the malware's true C2 endpoint hide behind ordinary-looking traffic to a legitimate developer platform. Second, using the address obtained this way, the app connected to infrastructure at api-a95f0ed200f.assisaint.com (with a related subdomain, bp-a95010ced.assisaint.com, secured by a 90-day TrustAsia certificate) to report device information and receive remote configuration and attack commands; the parent domain assisaint.com was registered on 2026-09-12 - the same day v1.2 shipped - through Cloudflare, which also proxy-masked the origin server. Investigators observed the malicious traffic executing on a recurring, automated schedule, indicating the attack functions were live and operating against real users rather than dormant or test code.

Distribution leaned on crypto KOLs, communities, and invite/referral codes, with new users required to register with a referral code, set a "security code," add real wallets for monitoring, and run the app on a physical device for several minutes before qualifying for a 5-7 USDT reward - a gate that both drove organic growth and plausibly filtered out emulator/automated-review environments before the malicious payload engaged. The first public report of asset theft came from X user 金灰 (@GXingPing), who posted at approximately 17:11 UTC on 2026-09-16 that they had lost funds after using FomoPeek and urged others to uninstall it - three days ahead of the formal vendor disclosure. SlowMist, working jointly with OKX's security team, published a public threat-intelligence report and asset-theft warning on 2026-09-19; Binance Wallet and Gate.io issued their own user-facing advisories the same day referencing SlowMist's findings, with Gate.io stating its background risk-control systems had prevented losses for its own users. SlowMist's MistTrack on-chain tracing identified an attacker-controlled address that received a total of 579,984.34 USDT (activity beginning 2026-09-15), with funds spanning Ethereum and BNB Chain (reporting varies on the third chain involved, naming either TRON or Arbitrum) and routed through cross-chain swap/bridge services - including OKX DEX, Meson.fi, Relay.link, Mayan Finance, and FixedFloat - to consolidate on Ethereum. The developer shipped version 1.3 on 2026-09-17, removing both malicious modules outright (the IPA shrank from 10.47MB to 1.81MB); Apple removed FomoPeek from the App Store on 2026-09-20, and DNS delegation for the app's own fomopeek.com domain (registered 2026-08-28 via nameservers ns1/ns2.jtdnsv1.com, AS140227, Hong Kong) went dead the same day. On 2026-09-20, SlowMist founder Cos separately warned that ComeCome, an iOS food-delivery app at comecome.icu, was suspected of embedding a malicious SDK using an attack methodology similar to FomoPeek's - no shared infrastructure has been confirmed, but the near-simultaneous discovery indicates a broader pattern of App Store poisoning targeting crypto-adjacent iOS apps, with Cos also flagging potential risk extending to iPad and Mac devices. No CVE has been assigned and no threat-actor attribution has been publicly disclosed; the campaign's exclusive focus on wallet credential theft indicates financial motivation.

## MITRE ATT&CK

- T1661 Application Versioning
- T1404 Exploitation for Privilege Escalation
- T1633 Virtualization/Sandbox Evasion
- T1634.001 Keychain
- T1414 Clipboard Data
- T1409 Stored Application Data
- T1420 File and Directory Discovery
- T1418 Software Discovery
- T1426 System Information Discovery
- T1481.001 Dead Drop Resolver
- T1481.002 Bidirectional Communication
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel

## Sources

- [Threat Intelligence | Analysis of FomoPeek App Store Poisoning and iOS Kernel Exploitation](https://slowmist.medium.com/threat-intelligence-analysis-of-fomopeek-app-store-poisoning-and-ios-kernel-exploitation-e568762d11ca)
- [FomoPeek app versions 1.1-1.2 exposed users to private key theft through hidden iOS exploit](https://cryptobriefing.com/fomopeek-app-private-key-theft-ios-exploit/)
- [SlowMist Issues Asset Theft Risk Warning for FomoPeek App Versions 1.1-1.2](https://panews.io/articles/01a0b876-caf4-7315-81c0-6e8c161fb932)
- [FomoPeek Malware: How a Read-Only Whale Tracker Stole iOS Private Keys](https://paragraph.com/@onchaindiary/fomopeek-app-malware-explained)
- [FomoPeek iOS App Malware Exposes Crypto Keys as Users Report Wallet Drains](https://cryptoadventure.com/fomopeek-ios-app-malware-exposes-crypto-keys-as-users-report-wallet-drains/)
- [FomoPeek 1.1/1.2 Malicious Module: iOS Kernel Data Theft](https://www.wublock123.com/news/fomopeek-1-1-1-2-malicious-module-ios-kernel-data-theft-68708)
- [SlowMist Reports Analysis of FomoPeek App Store Poisoning](https://coinfomania.com/slowmist-reports-analysis-of-fomopeek-app-store-poisoning/)
- [Gate Warns of FomoPeek iOS Malware That Steals Wallet Logins](https://www.spendnode.io/blog/gate-io-fomopeek-ios-malware-wallet-credential-theft-september-2026/)
- [SlowMist: ComeCome Food Delivery App Suspected of Embedding Malicious SDK, Attack Method Mirrors FomoPeek Crypto Theft](https://www.techflowpost.com/en-US/newsletter/137004)
- [Malicious iOS Food Delivery App "ComeCome" Suspected of Stealing Wallet Assets via Poisoning](https://panews.io/articles/01a0be2a-5028-750a-ac6e-c02a04e2abda)
- [SlowMist Warns FomoPeek iOS Versions May Expose Crypto Wallet Keys](https://www.cryptotimes.io/2026/09/19/slowmist-warns-fomopeek-ios-versions-may-expose-crypto-wallet-keys/)
- [Crypto Users Warned After FomoPeek iOS App Exposes Private Keys](https://coinspress.com/crypto-users-warned-after-fomopeek-ios-app-exposes-private-keys/)
- [Binance Wallet and SlowMist jointly issued an urgent security alert](https://www.okx.com/en-us/orbit/insight/87832914738016)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2591