FomoPeek on the App Store: SlowMist links ~$580K wallet thefts
SlowMist (with OKX security) tied malicious FomoPeek iOS builds from Apple’s App Store to roughly 580k USDT consolidated at an attacker address.
2 (about 9–12 Sep 2026) carried hidden modules that could leave the app sandbox and reach other apps’ data. 3 (17 Sep) removed those pieces. Target list in server config named many wallets and Apple Notes.
SlowMist confirmed data collection in a lab setting; it did not claim every named wallet lost a seed. Funds moved across chains toward mixers and exchanges. 2: treat credentials as burned, make a new wallet on a clean device, move funds.
Research snapshot from SlowMist / Cointelegraph.
369 take
App Store badge is not a free pass. A normal-looking app can still reach wallet data on the same phone.
Pulse lesson: keep seeds off phones that install random crypto tools; if you ran a bad build, migrate from a clean device. Same hygiene lane as stealer and fake-recovery malware on the board.
Sources