$580,000 in USDT Stolen by Rogue iPhone App

A malicious iPhone app called FomoPeek was distributed through Apple's App Store and stole nearly $580,000 in USDT from unsuspecting users. The app claimed to be a read-only tool for tracking large cryptocurrency transactions across Ethereum, Solana, and Tron.

However, security researchers at SlowMist discovered that versions 1.1 and 1.2 of the app contained two hidden modules with no connection to its advertised monitoring functions. One module communicated with external command-and-control infrastructure, while the other contained a kernel exploitation framework capable of breaching Apple's application sandbox.

The researchers found that the exploit could access Keychain information and files belonging to other apps on the device, including private keys, seed phrases, and login credentials. SlowMist founder Yu Xian explained that if an attacker obtained both, they could potentially unlock wallet credentials and sensitive information stored on the device.

The malicious components were not present in FomoPeek's original release but appeared in version 1.1, released on September 9, and version 1.2 on September 12. They were later removed in version 1.3 on September 17. Salus, a blockchain analysis firm, identified the attacker address as 0x6d37f2C5e8F8546b648D317295565dA95975f4BB and estimated proceeds from the incident at around $579,900 USDT.