FakeWallet Apps Impersonated Crypto Wallets to Steal Seed Phrases
Summary
Kaspersky identified 26 FakeWallet apps impersonating crypto wallets to steal seed phrases through phishing and trojanized apps sideloaded with iOS provisioning profiles. Apple removed the apps after disclosure.
Key points
- The apps impersonated wallets including MetaMask, Coinbase, Trust Wallet, OneKey, and Ledger, and were disguised as games or calculators.
- Kaspersky named the campaign FakeWallet and linked it to the SparkKitty operation.
- The apps redirected users to phishing pages that delivered trojanized wallets using abused iOS provisioning profiles.
- The trojanized apps intercepted wallet recovery phrases, encrypted them with RSA and Base64, and sent them to attackers.
- For cold wallets such as Ledger, phishing prompts asked users to enter seed phrases manually.
- Kaspersky said the campaign primarily targeted users in China; Apple removed all 26 apps after disclosure.
Article Details
- Event Type
- Malicious crypto-wallet app campaign involving impersonation and seed-phrase theft
- Impact
- Kaspersky reported that 26 malicious apps on the Apple App Store impersonated cryptocurrency wallets and targeted users primarily in China. The apps redirected users to phishing pages and trojanized wallet apps that captured or solicited recovery phrases, which attackers could use to restore victims’ wallets and steal funds. Kaspersky said the malware could affect users globally if the operators expanded their targeting. Apple removed the 26 apps after Kaspersky’s disclosure.
Vendors
Products
App StoreA set of 26 malicious apps on Apple App Store impersonate popular wallets, such as Metamask, Coinbase, Trust Wallet, and OneKey, to steal recovery or seed phrases and drain them of cryptocurrency assets.CoinbaseFakeWallet is a campaign of 26 malicious apps that impersonated popular wallets like MetaMask, Coinbase, Trust Wallet, OneKey, and Ledger to steal recovery/seed phrases and drain cryptocurrency.LedgerFakeWallet is a campaign of 26 malicious apps that impersonated popular wallets like MetaMask, Coinbase, Trust Wallet, OneKey, and Ledger to steal recovery/seed phrases and drain cryptocurrency.MetaMaskFakeWallet is a campaign of 26 malicious apps that impersonated popular wallets like MetaMask, Coinbase, Trust Wallet, OneKey, and Ledger to steal recovery/seed phrases and drain cryptocurrency.OneKeyFakeWallet is a campaign of 26 malicious apps that impersonated popular wallets like MetaMask, Coinbase, Trust Wallet, OneKey, and Ledger to steal recovery/seed phrases and drain cryptocurrency.Trust WalletFakeWallet is a campaign of 26 malicious apps that impersonated popular wallets like MetaMask, Coinbase, Trust Wallet, OneKey, and Ledger to steal recovery/seed phrases and drain cryptocurrency.