Threat Intelligence | Analysis of FomoPeek App Store Poisoning and iOS Kernel Exploitation

Recently, the SlowMist security team received multiple reports of user assets being stolen. Upon verification, all of the incidents involved private key exposure, and some of the affected users had previously downloaded and used FomoPeek App versions 1.1–1.2. Through a joint analysis with the OKX security team, we confirmed that FomoPeek 1.1 and 1.2 had the two malicious modules, apptrace and libapptracecore, embedded in them. These modules are capable of remote configuration, kernel exploit execution, sandbox escape, Keychain decryption, and cross-application data collection. Dynamic verification showed that the app retrieves an encrypted C2 address from Bitbucket and reports device information to api-a95f0ed200f.assisaint[.]com, while receiving remote configurations. During testing, the exploit_enabled value returned by the C2 was false.