FomoPeek versions 1.1 and 1.2 contained malicious modules that could bypass iPhone security protections, collect data from other apps and send it to a remote server, blockchain security firm SlowMist said in a Sept. 20 threat intelligence analysis. The app was marketed as a read-only on-chain monitoring and alerting tool that did not require a wallet connection or seed phrase. SlowMist and OKX’s security team began investigating after reports of stolen assets and exposed private keys. Comparing App Store releases showed that the modules were included in the officially distributed app: the code and FomoPeek were signed by the same Apple developer identity, while downloaded files retained App Store encryption records. The modules appeared in version 1.1, released Sept. 9, and version 1.2, released Sept. 12; they were absent from version 1.0 and removed in version 1.3 on Sept. 17. SlowMist traced funds to an address it identified as the attacker’s primary wallet. The address became active Sept. 15 and received 579,984.34 USDT across several blockchain networks, although that figure represents total receipts and is not a confirmed amount stolen through FomoPeek. One module retrieved an encrypted server address from Bitbucket, reported iPhone information and requested instructions. Investigators found that the server could select data for collection and control whether exploitation was attempted. In an isolated test, they enabled the otherwise disabled exploitation function and observed the app receive a list targeting 19 wallet and note-taking apps, upload the Apple Notes data container and send a reconstructed archive over decrypted network traffic. The test demonstrates the code’s capabilities but does not show what was collected from other users’ devices. FomoPeek’s code included DarkSwordStrategy, sharing its name with the DarkSword iOS exploit chain documented by Google Threat Intelligence Group in March. SlowMist warned that users of the affected versions should consider seed phrases, private keys and sensitive credentials on those devices potentially compromised, and recommended creating a new wallet on a secure device that never ran FomoPeek before moving assets from potentially exposed wallets. Deleting or updating the app cannot recover information already transmitted.