FomoPeek iOS Malware Could Steal Crypto Wallets

FomoPeek iOS versions 1.1 to 1.2 reportedly shipped with malware capable of compromising crypto wallets and accessing sensitive data on infected iPhones.

What happened

Security teams at @SlowMist_Team and OKX Wallet publicly reported investigating asset-theft cases tied to FomoPeek. According to those reports, affected builds were v1.1 and v1.2.

Researchers said the app included an iOS exploit framework with eight attack methods. That framework could reportedly escape the iOS sandbox and access or decrypt Keychain data, the same store many wallet apps rely on for secrets.

Reported affected iOS ranges include 12.0 to 18.7 and 26.0 to 26.1. Version 1.3 reportedly removed the exploit binary. That does not mean devices that already ran 1.1 or 1.2 are automatically clean, or that wallets used on those devices are safe.

What data could be exposed

According to the SlowMist / OKX reporting, exposed material could include:

• Private keys
• Seed phrases
• Login credentials
• Local files accessible after the reported sandbox escape

Treat any wallet that lived on a device with FomoPeek 1.1 or 1.2 as potentially compromised until funds are moved to a fresh wallet on a clean device.

What to do if you installed FomoPeek

1. Check wallets for suspicious outbound transactions.
2. Create a new wallet on a clean device, not the infected phone.
3. Move funds immediately from exposed wallets to the new one.
4. Rotate important passwords and active sessions.
5. Update iOS to the latest available build.
6. Delete FomoPeek and do not reinstall the affected versions.

Updating or deleting the app does not rotate keys that may already have left the device. If value already moved, open a case and preserve the outbound hashes before the trail peels further.