Malicious iPhone app breaks into the iOS sandbox and steals $580,000

FomoPeek, a malicious app that ran on Apple's App Store , has been linked to the theft of nearly $580,000 from its USDT account. An investigation by security firm SlowMist after receiving requests for help with users whose assets were stolen over the weekend found that the thief had previously exposed private key , which was widely installed in versions 1.1 or 1.2 of Fomo Peek. The application originally claimed to be a read-only tool used to track large amounts of cryptocurrency transactions on the Ethereum , Solana , and TRON networks.

Two suspicious modules hidden in the app

Analysis by Slow Fog in collaboration with security researchers at OKX found that both versions had embedded two modules unrelated to its claimed surveillance capabilities: one was responsible for controlling communication with external commands on the server , and the other built-in a set of kernel exploit frameworks containing eight attack modalities, which could be automatically adapted depending on the victim's iPhone model and system version.

Once the attack is successful, malicious code can bypass Apple's app sandbox isolation mechanism and directly read keychain information as well as other application files to obtain locally stored private key , seed phrase and login credentials without a user connecting a wallet or entering any seed phrase . The risk also extends to all kinds of passwords and encrypted applications file stored in Keychains.

It is noteworthy that these malicious components were not present in the initial release of FomoPeek. Slow fog confirmation, malware appeared in version 1.1 released on September 9 and version 1.2 published on September 12, which was subsequently removed in version 1.3 on September 17. The researchers also found that the framework can receive remote server instructions including whether to enable attacks as well as configuring how often an attack will be executed.

Nearly 580,000 USDT were transferred

After technical analysis, on-chain 's data further showed that the attacker had converted access rights into actual losses. blockchain analytics company Salus locked in an address of 0x6d37f2C5e8F8546b648D317295565dA95975f4BB and estimated the amount involved to be about 579,900 USDT .

Salus tracked that 401,028 USDT flowed through three intermediate addresses to FixedFloat; another 20,000 USDT , through two transactions, were merged into one exchange at the top-up address of hot wallet ; and 111,458 USDT were associated with a hosting platform identified by Salus. Another 10,000 USDT were transferred via CCE's hybrid service to related hosts.

Multiple platforms issued warnings and recommendations for disposal

Given the scale of the loss and scope of the vulnerability, multiple encryption platforms including Binance , OKX , Gate, Bitget Wallet and Rabby have issued risk warnings in succession. In the announcement, Binance said that FomoPeek versions 1.1 to 1.2 contained malicious code which could be used by the iOS system flaw to gain top-level permissions on a device and then access sensitive data such as private key and seed phrase login credentials, chat logs and files stored on the device.

The platforms' disposal recommendations are basically the same: uninstall FomoPeek immediately, update iOS to the latest version of system update , and create a new wallet on an entirely new device that has never installed the app. Transferring assets must be replaced with brand-new credentials because neither deleting apps nor upgrading systems can invalidate already copied private key .

The incident also sparked a discussion about the iPhone encryption algorithm. Two months ago, investigator Zach XBT of on-chain suggested that an iPhone , which was specifically designed for storing and signing transactions on crypto asset , might be more reliable than the existing hardware wallet , provided it is completely isolated from everyday browsing or communication activities. FomoPeek revealed another weakness in this model: the application itself was developed for cryptographic users and distributed through Apple's official store with tools to break through system isolation mechanisms.

For now, the focus is on controlling further losses and tracking down stolen funds. Salus continues to monitor addresses associated with remaining embezzlement, while platforms such as Binance are also sifting through possible records of top-up in order to give investigators more opportunities to track or freeze stolen USDT .