Kaspersky Finds 26 Fake Crypto Wallet Apps on Apple App Store
Summary
Kaspersky says 26 FakeWallet phishing apps on Apple's App Store targeted crypto wallet recovery phrases and private keys. Apple has begun removing them; Kaspersky links the campaign to SparkKitty based on shared indicators.
Key points
- Kaspersky identified 26 phishing apps mimicking major cryptocurrency wallets, many appearing in Chinese App Store search results.
- The apps were designed to direct users to install infected wallet versions and included code to harvest recovery phrases and hijack wallet-restoration methods.
- Some apps targeted Ledger cold wallets using two implants; Kaspersky also found a fake Ledger website and compromised Android wallet apps distributed through Chinese-language phishing pages.
- The apps appeared focused on Chinese speakers, but their malicious modules had no built-in regional restrictions.
- Kaspersky said the campaign appears linked to SparkKitty based on distribution methods, cryptocurrency-wallet targeting, Chinese-language logs, and SparkKitty modules found in some apps.
- Apple was notified and has started removing the malicious apps.
Article Details
- Event Type
- Phishing campaign involving malicious cryptocurrency wallet apps published to the Apple App Store and compromised Android wallet apps distributed through Chinese-language phishing pages.
- Impact
- Kaspersky identified 26 iOS phishing apps that mimicked major cryptocurrency wallets. The apps were designed to steal recovery phrases and private keys, hijack wallet-restoration methods, and target Ledger cold wallets. Apple was notified and began removing the malicious apps. The apps appear to target Chinese speakers, but their malicious modules had no built-in regional restrictions.
Malware
Vendors
AppleOver two dozen fake cryptocurrency applications targeting iOS users have been published to the Apple App Store, Kaspersky reports.LedgerKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.
Products
App StoreOver two dozen fake cryptocurrency applications targeting iOS users have been published to the Apple App Store, Kaspersky reports.BitpieKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.CoinbaseKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.imTokenKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.iOSOver two dozen fake cryptocurrency applications targeting iOS users have been published to the Apple App Store, Kaspersky reports.LedgerKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.MetaMaskKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.TokenPocketKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.Trust WalletKaspersky identified a total of 26 such phishing applications that mimicked major wallets such as Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket, and Trust Wallet.