A chain monitoring tool that does not require a mnemonic phrase has been discovered to have implanted cross-application data theft modules, collecting targets involving 19 wallets and note-taking applications.

Written by: ChandlerZ, Foresight News

On September 20, blockchain security company Slow Mist released an analysis report on FomoPeek, revealing that a chain monitoring tool named FomoPeek, available on the App Store, had embedded two malicious modules, apptrace and libapptracecore, in versions 1.1 and 1.2 of FomoPeek, with capabilities for remote configuration, kernel vulnerability exploitation, sandbox escape, Keychain decryption, and cross-application data collection.

The framework's declared system version coverage at the code level is from iOS 12.0 to 18.7.2 and iOS 26.0 to 26.1, indicating that its attack targets are not solely limited to older systems or devices.

The investigation began following reports from multiple users about asset theft, with related incidents involving private key leaks, and some users having used these two versions before the thefts occurred.

The investigation states that, from the public information available, FomoPeek features all the appearances of a legitimate project:

Project public information App Name FomoPeek – Whale Tracker & Smart Alerts App Store ID 6806199011 First Release 2026/8/29 Developer Display Name WhaleScan vSeller / Legal Entity Porter Manufacturing, L.L.C. Official Website fomopeek[.]com Official X @FomoPeek Targeting Solana / Ethereum / TRON wallet monitoring, Whale Tracking, on-chain alert system requires iOS 16.0+ Price / Category Free / Finance Current Version 1.3 (updated 2026-09-18)

The App is listed normally on the App Store, has an official website and social media accounts, making it difficult to link it to kernel exploitation based solely on its appearance, both from the review and user perspectives.

It is reported that FomoPeek targets crypto users who want to track whale transactions, supporting monitoring of wallet activities on Solana, Ethereum, and TRON. Users can add publicly available wallet addresses to receive on-chain alerts, and the application claims to be read-only, not connecting to wallets or requiring mnemonic phrases. However, in Slow Mist's isolation testing, the program obtained a collection list containing 19 wallets and note-taking applications, packaging and uploading Apple Notes data.

Downloaded from the official store, malicious code enters phones with version updates

According to promotional materials compiled by Slow Mist, FomoPeek attracted users through crypto KOLs, communities, and invitation codes. Participants needed to download, register, set a security code, and add monitoring wallets, then operate for 5 to 7 minutes on a real iPhone before being eligible to receive 5 to 7 USDT after verification. Some promotions limited each phone to participate only once and did not accept cloud phones.

For users who are already accustomed to using on-chain browsers and whale tracking tools, adding public addresses is a common operation. Wallet addresses can display assets and transaction activities but cannot be used to sign transfers; promotions also did not require participants to pre-fund, give up mnemonic phrases, or approve transactions, making it easy for users to misjudge the risk based on whether they relinquished asset control.

Historical installation packages obtained by Slow Mist show that the first version 1.0, released on August 29, did not contain the described malicious modules, with version 1.1, released on September 9, being the first to include related code, and version 1.2, on September 12, continuing to use it. On September 16, social media platforms began to see users warning about asset theft after downloading; the version 1.3, released on September 17, removed the two modules, reducing the installation package size from 10.47MB to 1.81MB.

The main program and two malicious modules use the same Apple developer signature entity, and the original installation package retained the encrypted metadata used for App Store distribution. The research team confirmed that the malicious modules were included in the official versions submitted by the developer. Even if users did not install enterprise-signed software or download from third-party websites, they could still receive these affected versions.

The report also found that the store's privacy label indicated no data collection, while the application's own privacy policy listed device identifiers, push tokens, email, password hashes, and wallet addresses added by users. For ordinary users, it is difficult to discover the subsequently added attack code within the installation package by only checking the store page, official website, and social accounts.

From device reconnaissance to data exfiltration, how does a wallet become a target?

Apple restricts the files that third-party applications can access through a sandbox, with each application having its own data directory. The system Keychain provides controlled storage for passwords, keys, and login tokens, with the system verifying which applications have the right to read. Under normal permissions, an application monitoring publicly available transactions on a chain cannot directly browse the private data saved by another wallet.

The two modules implanted in FomoPeek serve different purposes: apptrace connects to the attacker's control server, while libapptracecore contains the exploitation and data collection code. They are loaded when the application starts, with hidden code remaining in the same application process while users view normal business interfaces.

Researchers captured a list containing 135 application identifiers during testing; with this information, the server could determine which wallets were installed on the phone and then instruct the device on what to collect, without requiring the user to select or input wallet names in the interface.

The server also controls whether to initiate exploitation, repeat executions, and execution intervals. The server's address can be changed remotely, allowing the attacker to adjust targets and operational arrangements without needing to republish the application for each change. The version number and normal functionality that users see can remain unchanged, while the commands received in the background may differ.

According to the attack design restored by Slow Mist, the framework subsequently selects exploitation schemes based on the system version and device model, attempting to gain kernel access capabilities exceeding those of ordinary applications. The kernel is responsible for managing system resources and permissions, and once related vulnerabilities are successfully exploited, malicious programs may bypass existing access restrictions to read other application directories and attempt to extract and decrypt sensitive information from the Keychain.

The code contains 8 sets of exploitation strategies, with a declared compatible range including iOS 12.0 to 18.7.2 and 26.0 to 26.1.

During isolation testing, the initial return from the server had the exploitation switch turned off; after researchers manually enabled it, the client obtained collection configurations for 19 wallets and note applications, including MetaMask, OKX Wallet, Trust Wallet, imToken, TokenPocket, and TronLink. The configurations pointed to these applications' key storage, databases, and local files, including the entire Apple Notes data directory.

Subsequently, the team captured an approximately 46KB upload compressed package, which revealed the notes database and related files upon unpacking. The data collected is temporarily stored in FomoPeek's own directory before being sent to a remote server. As a result, notes may also become a source of wallet leakage: if users copy mnemonic phrases into notes, attackers only need to obtain this backup to restore the corresponding wallet.

For ordinary self-hosted wallets using mnemonic phrases and private keys, those who obtain usable keys can restore accounts on their own devices and sign transactions. The transfer commands are issued by the attacker, and the wallet on the original phone does not need to pop up a confirmation window. Even if users do not actively input mnemonic phrases to FomoPeek, they may still lose assets due to data being read from the same device.

According to a major attacker address analyzed in the report by Slow Mist’s tracking tool MistTrack, it has been active since September 15, accumulating a total income of 579,984.34 USDT as of the report's release. The funds involve Ethereum, BNB Chain, and Arbitrum, with most consolidated into Ethereum and then transferred out in batches. An address downstream received a total of 159,000 USDT, which was all transferred to the exchange FixedFloat, while another address received 47,028 USDT that was sent to both exchanges KuCoin and FixedFloat.

Backups in albums and notes may also be used to restore wallets

FomoPeek simultaneously lists wallets and notes as collection targets, exposing plaintext backups along with the wallet's own data files to the attack. The same person managing assets with several different wallets, as long as they are installed on the same affected device or mnemonic phrases are concentrated in the same note-taking application, still faces a risk of simultaneous reading.

In February 2025, Kaspersky disclosed a spyware program called SparkCat, discovering applications with malicious components infiltrating the App Store and Google Play, which included the food delivery application ComeCome. The application requests photo album access through legitimate business requests, and once granted, it scans accessible images, uses optical character recognition to search for mnemonic phrases, and uploads any identified images.

SparkCat relies on photo album access permissions to find plaintext backups, while FomoPeek includes code attempting to break through system isolation; the former can turn a screenshot of a mnemonic phrase into a theft entry point, while the latter further incorporates data saved by other applications into the collection targets. Whether the wallet interface is legitimate or whether users have clicked on suspicious authorizations cannot solely rule out these two types of leaks.

Hardware wallets also need to properly protect mnemonic backups; Ledger's security guidelines recommend not photographing recovery phrases or inputting them on computers or phones. Even if transaction signatures are completed on the hardware device, a complete recovery phrase left in the phone's album or notes may still be used by others to reconstruct a wallet.

How to handle assets and devices if affected versions have been installed?

Slow Mist recommends that users who have used FomoPeek versions 1.1 or 1.2 stop running the application, do not reinstall it, and dispose of related mnemonic phrases, private keys, and sensitive credentials as if they have been leaked. Version 1.3 removed the modules, which only signifies that this version no longer carries the stated code, and does not recover any data that may have already been uploaded.

Asset migration should be conducted on a device that has never installed FomoPeek, has updated the system, and has a trusted source, with new wallets generating completely new mnemonic phrases. Importing an old mnemonic phrase into another wallet would restore the original account; creating new accounts under the same group of mnemonic phrases would continue to be controlled by that same group. Various chain tokens, NFTs, and assets still in protocols need to be checked separately to avoid only migrating the most visible balances on the interface.

The wallet unlock password is generally used only to protect local access, and changing it does not change the private keys on the chain. Revoking token authorizations can cancel a contract's withdrawal permissions, but it cannot prevent someone already possessing the private key from resuming transactions. For keys that may have been leaked, handling should include migrating assets out and ceasing to use the old account.

If during migration the newly topped-up fees are immediately transferred away, cease repetitive funding since the compromised wallet may be monitored by automatic coin-sweeping programs, and any further tokens sent for fee payments could also be taken by others. At this point, contact the wallet's official support or a trusted security team to assess subsequent operations, avoiding giving out mnemonic phrases to strangers for help.

Emails, trading platforms, and other important accounts on the device should also have login records and unfamiliar sessions checked; change related passwords on secure devices, log out of suspicious logins, and enable two-factor authentication. If the Apple or Google login accounts affiliated with the wallet also have a risk of being leaked, they should be addressed as well, and suspicious accounts should not continue to provide recovery access for the new wallet.

Before dealing with the phone, save the application version, installation time, hash of abnormal transactions, and related screenshots; users who have already experienced theft should confirm evidence collection needs with official customer support or security teams before deciding whether to wipe and reinstall the device. Ensure the device has its latest supported security updates installed, but updating the system will not invalidate already leaked keys.

Rewards collection and testing new applications can be done using a separate device from managing primary assets. Phones used for managing assets should minimize the installation of unrelated applications, and mnemonic phrases should avoid being kept in plaintext in albums, notes, and chat histories. Read-only monitoring functions can use public addresses, and devices storing signing keys should minimize interactions with software that hasn't been fully vetted.