Threat Intelligence | Analysis of FomoPeek App Store Poisoning and iOS Kernel Exploitation

I. Background

1.1 From User Feedback to Sample Attribution

Some customers whose property had been stolen had put in and used FomoPeek earlier than the incidents occurred. To confirm its reference to the non-public key publicity incidents, we obtained historical-version IPAs of the app by way of the official App Store channel and carried out a version-by-version evaluation of the package deal construction, loading dependencies, signing possession, and binary contents.

1.2 An App That Looked Completely Legitimate

From the publicly out there data, FomoPeek had all of the outward appearances of a standard venture:

GET hxxps://bitbucket[.]org/discordseven/textual content/uncooked/major/xxhVOn

The repository (bitbucket[.]org/discordseven/textual content) is public. Its README and .gitignore are each default Bitbucket templates and are solely used for disguise. The repository was created on 2026-08-04, and the commit writer’s electronic mail deal with is discdseven@outlook.com. The xxhVOn file is an encrypted record of C2 addresses:

• The file is a 48-byte AES-CBC ciphertext.
• After startup, the shopper makes use of an embedded key to decrypt it, acquiring the C2 deal with record [“hxxps://api-a95f0ed200f.assisaint[.]com”].
• The file has been modified thrice traditionally: 2026–08–04 (64 bytes), 2026–08–06 (48 bytes), and 2026–09–13 (48 bytes, the day after model 1.2 was launched).

By modifying this single public file, the attacker can substitute the C2 deal with for all affected units with out having to launch a brand new model of the App.

② C2 Reporting: Encrypted Device Information and Remote Commands

The C2 area assisaint[.]com was registered on 2026-09-12 (the precise day model 1.2 was listed), with Cloudflare because the registrar and the origin server hid behind a fronting setup. CT logs additionally present one other subdomain beneath the identical area, bp-a95010ced.assisaint[.]com (with a 90-day certificates issued by TrustAsia).

③ Decryption Results

The shopper makes use of FrequentCrypto’s CCCrypt (alg = kCCAlgorithmAES(0), choices = kCCOptionPKCS7Padding(1), i.e., AES-CBC + PKCS7) to encrypt the message physique. By hooking this operate, we obtained the session key for this communication session and decrypted the plaintext in each instructions:

We reconstructed the archive itself from this request, and the archive contents had been the Apple Notes container:

group.com.apple.notes/NoteStore.sqlite                                  307,200
group.com.apple.notes/NoteStore.sqlite-shm                               32,768
group.com.apple.notes/.com.apple.mobile_container_manager.metadata.plist    577
group.com.apple.notes/Library/Preferences/group.com.apple.notes.plist      127
group.com.apple.notes/NoteStore.sqlite-wal / com.apple.notes.databaseopen.lock

At this level, we verified the goal container studying, file packaging, and knowledge add course of in an remoted testing surroundings. Combined with the kernel exploitation, privilege escalation, and sandbox escape code within the framework, its designed execution chain might be reconstructed as: distant configuration supply → kernel exploitation and privilege escalation → goal knowledge assortment → packaging and add.

3.9 Other C2 Endpoints: Application Enumeration and Execution Reporting

In addition to the configuration supply and knowledge exfiltration endpoints, we additionally confirmed two supporting endpoints that collectively type an entire C2 protocol of “reconnaissance → command supply → assortment → reporting.”

① /api/machine/apps: Reporting the Installed Application List

After decrypting the params part of this request utilizing the identical KEY/IV, we obtained an inventory of the bundle IDs of all 135 functions put in on the machine:

{"app_uuid":"7A5475A0007346BCB6EDB30E43315999",

"apps":["com.apple.Home.HomeControlService","com.apple.CarCamera","com.debank.rabby-mobile-regression","com.apple.ScreenSharingViewService","com.okx.wallet", … a total of 135 entries …]}

The function of this record is easy: primarily based on it, the server determines which wallets are put in on the machine and then decides which collect_configs to ship.

② /api/machine/report: Execution Result Reporting and Subsequent Commands

③ Summary of Confirmed C2 Endpoints

The deal with’s fund exercise spans a number of chains, together with Ethereum, BNB Chain, and Arbitrum, and funds had been nonetheless repeatedly flowing into it as of the time of publication. Its present steadiness is as follows:

Most of the funds held by this deal with had been consolidated on the Ethereum community. Funds on the opposite chains had been primarily transformed to USDT by way of cross-chain/swap platforms similar to OKX DEX, Meson.fi, Relay.hyperlink, and Mayan Finance, and then bridged to Ethereum.

Subsequently, the deal with transferred the consolidated USDT in batches to the next downstream addresses:

(1) 0x0A571f0Fa18D7EB9abcc1e98a0Bb9bC15534BbAe

The deal with at the moment holds 24,352 USDT. Notably, this deal with grew to become lively as early as May 23, earlier than the principle assault window of this incident.

It has interacted with FixedFloat, cce.money, OKX, and others:

In addition, a comparatively great amount of 111,458 USDT was transferred to the deal with 0x4c73d7e8ef0e61129403e219debc597fd43aa0ec and then transferred into USDT0: UsdtOFT for cross-chain switch.

The cross-chain receiving deal with is the TRON deal with TF2hm96RC2Aqon9FeQjGidofoC2J1zM8v1. This deal with has acquired a complete of 2,123,570.8821 USDT, which was subsequently dispersed throughout a number of addresses and transferred to suspected OTC platforms.

(2) 0x0DF6aC2e2856114228756947d1b1d9Ff63eA3e68

The deal with has acquired a complete of 159,000 USDT:

All funds had been transferred to FixedFloat:

(3) 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be

The deal with has acquired a complete of 47,028 USDT:

Of this quantity, 10,000 USDT was transferred to KuCoin, whereas the remaining 37,028 USDT was transferred to FixedFloat:

(4) 0x111faeb95cd0786593433bcc762dc5c1debf541c

The deal with has acquired a complete of 227,154 USDT:

215,000 USDT was transferred to FixedFloat, and 10,000 USDT was transferred to cce.money:

The remaining 2,154 USDT was transformed by way of Bridgers Swap into 6,432.54 TRX and cross-chained to the TRON deal with TUi5qPcjDuqbmwfunMbzwkpLNhaqRpqcJg, with most of the TRX in the end transferred to FixedFloat. Notably, a good portion of the funds acquired by the TUi5q deal with got here from cce.money:

We will proceed to observe the fund actions of the above addresses. If you will have ever put in FomoPeek and lately skilled asset theft, you possibly can submit the stolen deal with and hacker deal with by way of the next hyperlink: https://aml.slowmist.com/cn/recovery-funds.html.

VI. Threat Indicators (IOC)

URL :

hxxps://api-a95f0ed200f.assisaint.com/api/machine/config

hxxps://bp-a95010ced.assisaint.com

hxxps://admin-e433360cb0e.assisaint.com

hxxps://customer-c1cb36b5.assisaint.com

hxxps://bitbucket.org/discordseven/textual content/uncooked/major/xxhVOn

Domain:

assisaint[.]com

api-a95f0ed200f[.]assisaint.com

bp-a95010ced[.]assisaint.com

admin-e433360cb0e[.]assisaint.com

customer-c1cb36b5[.]assisaint.com

File:

FomoPeek-1.1–891048157.ipa

MD5: fce99b45709a6f8e241175be0c121874

SHA-256: d6b6407b4c97697fdde174cbc190b6433315470f58df6b483ac5b806f35e20f9

FomoPeek-1.1.ipa

MD5: f5bdaed5953033ac8c3256f2933b9a81

SHA-256: ca5dfd0fa7a16f26f5b369516f5b8bcac1d5a6fe01a8511a5ededf4cd2c0d042

FomoPeek-1.2.ipa

MD5: 38a8a5ddecd9a5626b42dae593ac28f6

SHA-256: 48f9d5623af1518e774d57c41e6e0b915a7e9f896909bf596a9b27de5022911e

apptrace

MD5: 645b9053390246995c2cb7a9b9eddf40

SHA-256: 764663ff5c8bd1bdf33bbd1ec352ce262a4fe79695456f2612dc27c35840ab9d

libapptracecore

MD5: 03d67a68b5e8507dbbe36f2a4b41aca0

SHA-256: f0b3be01e8597f7f35ca36c009f68e7004527fe4a01d4349a01e211ca16de1e2

VII. Investigation and Mitigation Recommendations

7.1 User Side

If your machine has ever put in FomoPeek model 1.1 or 1.2, please word: uninstalling the app or upgrading to 1.3 doesn’t imply that the machine is already safe. Once the framework has been efficiently exploited, the information it accessed has already left the machine.

1. Immediately cease utilizing the app and don’t reinstall it;
2. On a safe machine that has by no means put in the app, create a brand new pockets, generate a totally new seed phrase, and switch your property; deal with all previous seed phrases and non-public keys as compromised and don’t reuse them;
3. Check for irregular transfers and authorization information throughout accounts on every chain, and revoke authorizations which are now not in use;
4. Change the passwords and login credentials used on the machine and allow two-factor authentication;
5. Check whether or not the machine has put in any configuration profiles / MDM, or whether or not it has been sideloaded or jailbroken; if obligatory, erase the machine and reinstall the working system;
6. Preserve the machine and related proof (App model, set up time, irregular transaction information) for additional investigation;
7. If you uncover any irregular asset exercise, instantly contact the official buyer assist of the related platform.

7.2 Platform and Ecosystem Side

1. Add file hashes, class names, key strings, and community traits to pattern databases, EDR, and visitors detection guidelines;
2. Send focused threat alerts to customers who’ve put in FomoPeek 1.1 or 1.2, and deal with the circumstances as credential publicity incidents;
3. Block assisaint[.]com and its subdomains, in addition to bitbucket[.]org/discordseven/*;
4. Starting from September 9, 2026, evaluate entry logs for the Bitbucket useless drop, and ranging from September 12, evaluate DNS, proxy, EDR, VPN, and cellular machine logs associated to *.assisaint[.]com. If the log retention interval permits, additional hint again to August 4 to analyze entry to the Bitbucket repository and historic C2 configurations.

VIII. Conclusion

Through static evaluation and dynamic verification, we confirmed that FomoPeek 1.1 and 1.2 had two malicious modules, apptrace and libapptracecore, embedded in them, with capabilities together with distant configuration, kernel exploitation, sandbox escape, Keychain decryption, and cross-application knowledge assortment.

After triggering the related performance in an remoted surroundings, the pattern obtained a group record concentrating on 19 pockets and note-taking functions from the C2 and packaged and uploaded the Apple Notes container to /api/add/zip, verifying the whole technical chain from distant configuration and unauthorized entry to knowledge exfiltration.

The above-mentioned modules weren’t present in FomoPeek 1.0, had been first launched in 1.1, remained in 1.2, and had been utterly eliminated in 1.3. For customers who’ve used 1.1 or 1.2, uninstalling or upgrading the app alone can not rule out the danger of historic knowledge publicity. It is really helpful to deal with the related seed phrases, non-public keys, and delicate credentials as compromised.

Frequently Asked Questions (FAQ)

Q1: When did this incident happen?

The at the moment confirmed threat window is from September 9 to September 17, 2026.

FomoPeek 1.0 was first listed on August 29, when no related malicious modules had been discovered. Version 1.1, launched on September 9, first launched apptrace and libapptracecore, whereas model 1.2, launched on September 12, continued to hold the identical malicious code. It was not till model 1.3 was launched on September 17 that the 2 Frameworks had been utterly eliminated.

On September 16, alerts had already appeared on public social platforms relating to customers experiencing asset theft after putting in FomoPeek. Since the set up time and asset theft time of not all victims might be totally obtained, it’s at the moment unimaginable to find out the precise time when the earliest precise assault occurred primarily based on this data alone.

Q2: Which variations had been affected?

In phrases of App variations, the explicitly affected variations are FomoPeek 1.1 and 1.2.

• 1.0: No malicious modules had been discovered;
• 1.1: Malicious modules had been launched for the primary time;
• 1.2: Continued to hold the identical malicious modules;
• 1.3: The related Frameworks had been utterly eliminated.

Based on the iOS protection declared within the assault framework’s code, it incorporates 8 built-in exploitation methods overlaying iOS 12.0–18.7.2 and iOS 26.0–26.1, and selects the corresponding exploitation technique primarily based on the machine mannequin and system model.

It must be famous that FomoPeek’s App Store web page specifies iOS 16.0+ because the system requirement. Therefore, the “theoretical protection of the assault framework” and the “vary of units on which FomoPeek can really be put in by way of the App Store” are usually not precisely the identical idea.

Q3: Through what channels may the assault happen?

In this FomoPeek incident, the confirmed distribution entry level was the official App Store model itself, reasonably than a third-party re-signed, enterprise-signed, or sideloaded package deal. The malicious Frameworks and the principle program used the identical Apple signing entity, and the unique IPA additionally retained FairPlay encryption metadata.

FomoPeek primarily attracted customers to put in the App by way of crypto KOLs, communities, invitation codes, and small USDT rewards, and required customers to run it on an actual machine for a number of minutes.

However, from the angle of the assault approach itself, this sort of iOS kernel exploitation just isn’t essentially restricted to being hidden in a specific App. Similar capabilities may theoretically even be triggered by way of malicious or poisoned Apps, supply-chain elements, phishing pages, compromised web sites, and watering-hole pages deployed for particular teams.

The beforehand talked about public alerts associated to DarkSword additionally identified that attackers may doubtlessly mix social engineering or watering-hole assaults to induce targets to go to web sites or pages implanted with malicious code, thereby additional stealing knowledge from iPhones and iPads.

Therefore, don’t merely assume that one thing is totally protected as a result of it “comes from the App Store” or “comes from a web site that’s ceaselessly visited.”

This fall: What is a “Watering Hole Attack”?

The concept behind a “Watering Hole Attack” is to not immediately search out each sufferer, however to first determine locations that the goal group ceaselessly visits and trusts.

For instance, if an attacker needs to focus on a bunch of cryptocurrency professionals, they might first analyze which trade web sites, device websites, communities, venture web sites, or occasion pages these individuals ceaselessly go to, and then search for targets that may be compromised or implanted with malicious code.

Once these legit web sites are compromised, victims could enter the assault chain just by visiting the web sites as they usually would.

The identify comes from “watering holes” in nature: a predator doesn’t must chase each prey animal, however solely wants to attend at locations the place animals ceaselessly go to drink.

For cellular units, this “watering gap” will also be understood as a broader trusted entry level: it could possibly be a well-known web site, a long-used App, a third-party SDK, a neighborhood hyperlink, and even an replace to a legit utility.

Q5: Does this sort of threat exist solely in FomoPeek?

No.

What makes FomoPeek notably noteworthy just isn’t solely whether or not a specific pockets consumer put in this particular App, however that it as soon as once more demonstrates that an assault entry level could also be hidden in an utility that seems utterly legit, and even comes from an official app retailer.

Among publicly documented circumstances, ComeCome gives one other notable instance. Public evaluation confirmed that this can be a meals supply App concentrating on Chinese customers in areas similar to Dubai. Its model 2.9.3 was discovered to comprise a hidden element named DKStatistics, with capabilities to flee the iOS sandbox and entry knowledge from pockets Apps, WhatsApp, Apple Notes, and different functions. Public pages additionally disclosed related on-chain fund flows. It must be famous that the web site additionally explicitly distinguishes between “technical and on-chain details that may be publicly verified” and the boundary of “attribution of the precise attacker, which can’t be immediately established primarily based on these details.”

The takeaway from such circumstances is:

A “watering gap” doesn’t essentially appear to be a harmful web site. It could possibly be a web site, device, meals supply App, neighborhood hyperlink, and even software program downloaded from an official retailer that you just open each day.

By the normal definition, FomoPeek and ComeCome are extra precisely described as App poisoning / trusted-channel poisoning reasonably than basic web-based Watering Hole assaults. However, the underlying assault method could be very related: first enter an entry level trusted and ceaselessly utilized by the goal group, and then look forward to targets to voluntarily enter the assault surroundings.

Therefore, what actually wants consideration is not only FomoPeek. A watering gap could exist anyplace that’s long-term trusted by the goal group.

For reference, see the publicly out there ComeCome case: https://comecome.icu/

About MistEye

MistEye is a Web3 risk intelligence and dynamic safety monitoring platform independently developed by SlowMist. Through its API, it gives malicious exercise detection and provide chain threat alerts for open-source package deal ecosystems.

All malicious packages and IOCs concerned on this incident have been built-in into the MistEye risk detection engine. Developers can use the API to routinely scan venture dependencies, shortly decide whether or not they match recognized malicious packages, and acquire mitigation suggestions.

📖 API Documentation: https://app.misteye.io/api-docs

🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan A light-weight CLI device that scans venture dependencies and globally put in packages for recognized malicious packages with a single command. It helps the npm / PyPI / Cargo / Go / RubyGems ecosystems.

🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills A safety expertise package deal for coding assistants that routinely triggers MistEye safety checks earlier than dependency set up and URL entry.

🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard A DNS safety safety device that detects malicious domains and dangerous entry, and identifies community threats similar to phishing and C2.

This article was written by the SlowMist Threat Intelligence Team primarily based on the MistEye risk intelligence system and SlowMist Agent’s AI-powered evaluation. If you will have any questions, please be happy to contact us for session or suggestions.

About SlowMist

SlowMist is a risk intelligence agency centered on blockchain safety, established in January 2018. The agency was began by a group with over ten years of community safety expertise to develop into a world power. Our purpose is to make the blockchain ecosystem as safe as attainable for everybody. We at the moment are a famend worldwide blockchain safety agency that has labored on varied well-known initiatives similar to HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and many others.

SlowMist gives a range of companies that embody however are usually not restricted to safety audits, risk data, protection deployment, safety consultants, and different security-related companies. We additionally provide AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide corporations similar to Akamai, BitDefender, RC², TianJi Partners, IPIP, and many others. Our intensive work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a complete safety answer personalized to particular person initiatives, we are able to determine dangers and forestall them from occurring. Our group was capable of finding and publish a number of high-risk blockchain safety flaws. By doing so, we may unfold consciousness and elevate the safety requirements within the blockchain ecosystem.