FomoPeek app exploits iOS sandbox to steal nearly $580,000 in USDT

FomoPeek was a malicious iPhone app distributed through Apple's App Store. The app was marketed as a read-only tool for tracking large cryptocurrency transactions across Ethereum, Solana and Tron. SlowMist began investigating after receiving reports of stolen assets linked to exposed private keys. SlowMist found two unrelated modules in versions 1.1 and 1.2 with help from security researchers at OKX. One module communicated with external command-and-control infrastructure. The other contained a kernel exploitation framework with eight attack methods. The framework could adjust to the victim's iPhone model and operating-system version. A successful exploit could escape Apple's application sandbox and access Keychain information and files belonging to other apps. This created a route to locally stored private keys, seed phrases and login credentials without requiring users to connect a wallet or enter those details into FomoPeek. SlowMist founder Yu Xian said the risk also extended to passwords stored in Apple's Keychain and encrypted files held by other applications. The malicious components appeared in version 1.1 released Sept. 9 and version 1.2 released Sept. 12. FomoPeek removed the components in version 1.3 on Sept. 17. The framework could receive remote instructions that controlled whether exploitation was enabled and how often it would run. Salus estimated proceeds from the incident at about 579,900 USDT. Salus traced 401,028 USDT through three intermediary addresses to FixedFloat. Another 20,000 USDT moved through deposit addresses before reaching a KuCoin hot wallet. A further 111,458 USDT moved through an address that Salus associated with an escrow platform. Another 10,000 USDT passed through the CCE mixing service before reaching addresses linked to an escrow service. Salus said the group behind the incident had also been involved in a separate private-key theft in June. Investigators are still determining whether that attack used the same technique. Binance, OKX, Gate, Bitget Wallet and Rabby warned users about the app. The firms urged users to remove FomoPeek and update iOS. They also urged users to move assets to newly created wallets on devices where the app had never been installed. Deleting the app or patching the operating system cannot invalidate a private key that may already have been copied. Binance and other platforms are monitoring deposits linked to the stolen USDT.