FomoPeek App Found Using iOS Exploit to Steal Private Keys

Users of the whale tracking app FomoPeek are being warned that versions 1.1 and 1.2 contain malicious code designed to compromise private keys and mnemonic phrases. The alert, issued on September 19, 2026, by SlowMist and the OKX security team, follows reports of asset theft linked to the application.

While FomoPeek was marketed as a read-only tool for monitoring on-chain activity across Solana, Ethereum, and TRON, investigators discovered it contains a sophisticated iOS kernel exploit framework. This framework utilizes eight different attack methods to bypass iOS security and access the system Keychain, where passwords and cryptographic keys are stored.

The exploit targets a wide range of iOS versions, specifically 12.0 through 18.7 and 26.0 through 26.1. Researchers confirmed that the malware was actively connecting to remote servers to receive real-time commands during their investigation.

The danger of the app stems from its ability to access the shared iOS Keychain, which allows the malware to reach sensitive data even though the app itself does not execute trades or hold funds directly. Because the exploit can access cached credentials, any private keys or seed phrases stored on a compromised device are at risk.

SlowMist and OKX have advised affected users to immediately transfer their assets to new wallets created on a clean device that has never had FomoPeek installed. Users are also urged to uninstall the app, revoke existing wallet permissions, and monitor their transaction history for unauthorized activity.

The technical complexity of the FomoPeek malware, which includes active remote command execution and multiple exploit methods, marks a notable escalation in the tactics used to target crypto users.