FomoPeek, a read-only on-chain monitoring and alerting tool, contained malicious modules in versions 1.1 and 1.2 that could bypass iPhone security protections, collect data from other apps and transmit it to a remote server, blockchain security firm SlowMist said in a Sept. 20 threat intelligence analysis. SlowMist’s Cos separately said on X that the application was misidentified by overseas security influencers and media as an FOMO App, a description later repeated by domestic outlets. SlowMist and OKX’s security team investigated after reports of stolen assets and exposed private keys. The affected releases were distributed through Apple’s App Store, signed by the same Apple developer identity as the modules and retained App Store encryption records. Version 1.1 was released Sept. 9 and version 1.2 on Sept. 12; the code was absent from version 1.0 and removed in version 1.3 on Sept. 17. SlowMist traced 579,984.34 USDT in total receipts across several blockchain networks to an address it identified as the attacker’s primary wallet, but said the figure was not a confirmed amount stolen through FomoPeek. An isolated test showed the code could target 19 wallet and note-taking apps, upload Apple Notes data and send a reconstructed archive, although the test did not establish what was collected from other users’ devices.