Researchers Analyze Infrastructure Behind FakeWallet Crypto-Wallet Phishing

Summary

Researchers say FakeWallet used over 20 trojanized crypto-wallet apps to steal recovery phrases and private keys. Their infrastructure analysis identified 28 network IoCs and linked additional domains and IPs to malicious activity.

Key points

Researchers say more than 20 fake wallet apps redirected users to trojanized App Store pages that stole recovery phrases and private keys.
FakeWallet metadata suggests the campaign was active from at least fall 2025; five parent domains were updated on April 20, 2026, a day before the campaign was first detected.
The investigation examined 28 network IoCs: 12 subdomains, 15 domains, and one IP address. Its tools classified nine subdomains as malicious and two as requiring caution.
Historical DNS and traffic data showed one client IP communicating with three domain IoCs and nine potential victim IPs communicating with the sole IP IoC; these observations do not establish victim compromise.
WHOIS email analysis linked seven public email addresses to 10,812 domains; threat-intelligence queries identified 11 as previously weaponized. Of 18 additional IPs found, eight had appeared in attacks.
The researchers caution that some entities flagged as malicious may prove harmless and recommend further investigation to corroborate findings.

Article Details

Attack Vectors: More than 20 fake cryptocurrency wallet apps masqueraded as popular wallets and redirected users to fake App Store pages hosting trojanized apps.
The FakeWallet apps stole affected users’ recovery phrases and private keys.
The operation used look-alike domains and subdomains, several of which were flagged for malware distribution.
Defensive Notes: The article recommends conducting supplementary investigations to corroborate entities identified as malicious, since some may later prove harmless or change context.
The article notes that blocking Cloudflare IP addresses associated with a suspicious endpoint could disrupt legitimate traffic.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`6688cf[.]jhxrpbgq[.]com`	Subdomain flagged for malware distribution during 21–26 April 2026.
DOMAIN	`bitpiecn[.]com[.]cn`	Email-connected domain reported as used for malware distribution.
DOMAIN	`crypto-stroe[.]cc`	FakeWallet look-alike domain IoC that was bulk-registered alongside two related look-alike domains.
DOMAIN	`crypto-stroe[.]cn`	Look-alike domain bulk-registered with the FakeWallet domain IoC crypto-stroe[.]cc.
DOMAIN	`crypto-stroe[.]top`	Look-alike domain bulk-registered with the FakeWallet domain IoC crypto-stroe[.]cc.
DOMAIN	`gxzhrc[.]cn`	FakeWallet domain IoC reported as likely registered with malicious intent and listed in a malicious-domains feed.
DOMAIN	`jhxrpbgq[.]com`	FakeWallet domain IoC reported as likely registered with malicious intent and listed in a malicious-domains feed.
DOMAIN	`ld018[.]com`	Email-connected domain reported as used for malware distribution.
DOMAIN	`meta-mask[.]org[.]cn`	Email-connected domain reported as used for malware distribution.
DOMAIN	`mgi1y[.]siyangoil[.]com`	Subdomain flagged for malware distribution during 21–26 April 2026.
DOMAIN	`mti4ywy4[.]lahuafa[.]com`	Subdomain flagged for malware distribution during 21–26 April 2026.
DOMAIN	`one-key[.]org[.]cn`	Email-connected domain reported as used for malware distribution.
DOMAIN	`t0kenpocket[.]cn`	Email-connected domain reported as used for malware distribution.