A recent security breach involving a malicious iOS application named FomoPeek has resulted in the theft of nearly $580,000 in cryptocurrency. This app, which was available on Apple’s App Store, utilized multiple kernel exploits to bypass security measures and access sensitive wallet data, according to blockchain security firm SlowMist.
Uncovering the Breach
SlowMist, in collaboration with the OKX security team, investigated the app following user reports of asset theft. The investigation identified that FomoPeek contained two malicious modules exploiting iOS vulnerabilities to gain elevated privileges and access Keychain data. These vulnerabilities allowed the app to escape Apple’s sandbox—a security measure designed to isolate apps from the rest of the system.
The affected versions of the app were released on September 9 and September 12, with version 1.3 on September 17 removing these malicious components. This timeline indicates a swift response, yet the damage had already occurred, impacting users who downloaded the earlier versions.
Technical Exploitation and Impact
The exploit framework employed by FomoPeek included eight attack methods, supporting iOS versions from 12.0 to 18.7.2 and 26.0 to 26.1. This broad range of support showcases the app’s potential to target a wide array of devices, increasing its threat level.
SlowMist’s onchain analysis revealed a primary hacker address that received approximately 579,984 USDT, a figure closely mirroring the total stolen amount. This address became active on September 15, suggesting a premeditated strategy to consolidate and obscure the stolen funds across multiple blockchain networks.
Tracing the Stolen Funds
Once the assets were stolen, the funds were dispersed through various channels. Portions of the stolen cryptocurrency were transferred to services such as FixedFloat, KuCoin, and cce.cash. Additionally, funds were moved through several other addresses, complicating tracing efforts.
As SlowMist continues to trace these transactions, it highlights the challenges in tracking illicit activities across decentralized networks, where anonymity and rapid fund movement are inherent features.
Apple and Security Firms’ Response
Both Apple and the involved security firms have yet to comment publicly on this incident. However, SlowMist’s detailed analysis and collaboration with OKX underscore the importance of swift and coordinated responses to such breaches.
Security breaches of this nature highlight vulnerabilities even in platforms as renowned for security as Apple’s App Store. The incident serves as a reminder that users should remain vigilant, regularly updating apps and avoiding unfamiliar software.
What to Watch Next
- Monitoring the ongoing tracing of stolen funds by SlowMist and potential recovery efforts.
- Watching for security updates or policy changes from Apple in response to this breach.
- Potential regulatory actions or guidelines concerning app security on major platforms.
- Tracking the impact on cryptocurrency market trust and user behavior in app interactions.
Key Takeaways
- FomoPeek app led to a $580,000 cryptocurrency theft via iOS kernel exploits.
- Malicious components were active in app versions released on Sept. 9 and Sept. 12.
- Stolen funds were laundered through multiple blockchain networks and services.
- Security firms SlowMist and OKX are actively tracing the stolen assets.
