SlowMist issued a theft-risk warning for FomoPeek App versions 1.1 to 1.2 after receiving multiple user reports of stolen assets tied to private key leaks, saying a joint analysis with the OKX security team found the iOS application had been implanted with malicious code.

According to SlowMist, the compromised FomoPeek versions bundled two unrelated modules, including what it described as a professional iOS kernel attack framework with eight exploit schemes. The framework can automatically choose attack methods based on device model and system version, with listed affected iOS versions spanning iOS 12.0 to 18.7 and 26.0 to 26.1.

SlowMist said that if the attack succeeds, the app can bypass iOS sandbox isolation, read and decrypt the system keychain, and access data files from other applications on the device. That could expose stored private keys, mnemonic phrases, login credentials, chat records, and files. The firm also said the application connects to hidden servers for remote commands, and intercepted communications suggest the malicious functions are active.

The warning framed the risk as more than a routine software bug. SlowMist said users running lower iOS versions may face higher potential risk, and urged anyone who downloaded or used the app to check account security immediately, stop using the software, create new accounts and keys on a clean device, and transfer assets out as soon as possible.

Some outside technical reporting has pointed to a possible mnemonic-generation weakness in FomoPeek 1.1 to 1.2, but the warning released by SlowMist focused on implanted malicious code, device compromise, and private key leakage. No verified figure for affected users or total losses was disclosed in the available information.

Why It Matters

This case stands out because it targets the device layer where many retail users manage wallets, credentials, and exchange access in one place. A successful compromise at that level can cut across multiple apps and accounts at once, making the damage harder to contain than a single protocol exploit or phishing incident.

It also adds pressure on wallet providers, exchanges, and security teams to treat mobile distribution and endpoint integrity as a core crypto-security issue. For users, the warning underlines a basic but critical distinction: once keys or seed phrases may have been exposed on a compromised device, remediation may require full key rotation and fund migration rather than a simple app update.