SlowMist says malicious versions of the iOS app FomoPeek were distributed through Apple's App Store and used kernel exploits to break out of the iOS sandbox, an attack chain tied to roughly $580,000 in crypto theft.
Disclaimer: News content is based on public news sources and provided for information only. It does not constitute investment advice.
SlowMist, a blockchain security firm, identified malicious versions of the iOS app FomoPeek that were distributed through Apple's App Store. According to the report, those versions used iOS kernel exploits to escape the app sandbox. Once outside the sandbox, the malware could access sensitive data belonging to other apps. SlowMist linked the activity to approximately $580,000 in stolen cryptocurrency. The finding was reported on Sept. 23, 2026.
iOS normally confines each app to its own sandbox, a security boundary that limits access to files and data created by other applications. A kernel-level exploit targets the core of the operating system, where those isolation rules are enforced. If an app gains kernel-level control, the sandbox can stop functioning as an effective barrier. This matters for crypto users because wallet apps and related services often keep sensitive credentials on the device. Accessing another app's data could therefore expose material that is meant to remain private.
The reported distribution channel is significant because Apple's App Store is a curated marketplace with a review process. Malicious code reaching users through that official channel is different from attacks that rely on sideloading or third-party app stores. The FomoPeek case, as described by SlowMist, suggests that app review systems are not an absolute barrier. It also raises questions about how the malicious functionality evaded detection and how many users installed the affected versions. The available summary does not specify a victim count or the exact distribution period.
SlowMist connects the FomoPeek campaign to about $580,000 in stolen cryptocurrency. That figure is attributed to SlowMist, and the summary does not break down individual losses or say whether any funds were recovered. Crypto theft can be difficult to trace and reverse because blockchain transactions are generally irreversible once confirmed. Linking a specific dollar amount to a malware campaign requires forensic work that ties on-chain flows to a particular operation. The $580,000 total is therefore a central data point, but it is not a complete account of the incident's impact.
FomoPeek is an iOS app that SlowMist says was distributed in malicious versions through Apple's App Store. Those versions allegedly used iOS kernel exploits to escape the sandbox and access sensitive data from other apps. SlowMist links the campaign to approximately $580,000 in crypto theft.
The reported attack chain used kernel exploits to break out of the iOS sandbox, which normally isolates apps from one another. That escape could allow the malware to reach sensitive data stored by other applications, potentially including credentials or secrets used by crypto services. SlowMist attributes the resulting theft to the FomoPeek campaign, though the summary does not detail each victim's loss.
Apple's App Store is a curated marketplace with a review process, so users often treat it as a trusted source for software. Malicious code reaching users through that official channel differs from cases involving sideloading or third-party stores. The FomoPeek report suggests that even reviewed app marketplaces can be used as an attack vector.
What SlowMist Reported
Why a Sandbox Escape Matters on iOS
Distribution Through the App Store
The $580,000 Figure and Attribution
Broader Implications for Mobile Crypto Security
This article is rewritten from public news sources and further processed by AI. It is provided for information only and does not constitute investment advice — refer to the original source for the authoritative version.
The case highlights that mobile devices form part of the crypto attack surface, alongside desktop wallets and online exchanges. It also shows how an app distributed through a major platform can combine a trusted front end with an exploit chain. Because many iOS users treat the App Store as a safety signal, a successful malicious listing can reach a broad audience. The incident is likely to draw attention from security researchers, app reviewers, and crypto users. The summary does not indicate any regulatory response or public statement from Apple. Based on public news sources.
SlowMist links the FomoPeek campaign to about $580,000 in stolen crypto. The available summary does not provide a victim count, a per-user breakdown, or information about recovery. That figure is an attribution from SlowMist rather than a complete accounting of all possible losses.
The iOS sandbox confines each app to its own isolated environment and limits access to data created by other apps. This design reduces the damage a single compromised app can cause. A kernel-level exploit targets the lower-level code that enforces those boundaries, which is why escaping the sandbox is a serious security concern.
SlowMist is a blockchain security firm that investigates crypto-related incidents and publishes findings on hacks, scams, and malware. In this case, it reported that malicious FomoPeek versions were distributed through Apple's App Store and used iOS kernel exploits. Its finding ties the campaign to roughly $580,000 in crypto theft.
