SlowMist, working with the OKX security team, linked FomoPeek versions 1.1 and 1.2 to hidden modules capable of remote control, iOS kernel exploitation, sandbox escape, Keychain decryption and cross-application data collection. Marketed as a free read-only whale-tracking app for Solana, Ethereum and TRON, FomoPeek was distributed through Apple's App Store and told users it did not require wallet connections or seed phrases. Testing found configurations targeting 19 wallet and notes applications, including MetaMask, OKX Wallet, Trust Wallet, imToken, TokenPocket and TronLink, while researchers captured Apple Notes data and identified potential exposure of private keys, recovery phrases, credentials, conversations and local files. MistTrack identified a major attacker address that had received 579,984.34 USDT across Ethereum, BNB Chain and Arbitrum since September 15. Version 1.3 removed the modules on September 17, but SlowMist and Binance advised users of versions 1.1 and 1.2 to remove the app, treat wallet credentials as compromised and migrate assets from a clean device.