Researchers Find 26 App Store Lures for FakeWallet Crypto-Stealing Campaign
Summary
Researchers identified 26 App Store phishing apps that redirect users to trojanized wallets. FakeWallet variants hijack wallet screens or display phishing prompts to capture recovery phrases and send them to command-and-control servers.
Key points
- The 26 apps mimicked MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie; researchers reported the findings to Apple, and several apps were removed.
- The campaign, observed since at least fall 2025, used typosquatted listings and fake browser pages to direct users to provisioning-profile installers for infected wallets.
- On hot wallets, malicious libraries or modified app code intercepted recovery screens and collected mnemonic phrases.
- The malware encrypted captured phrases with RSA, Base64-encoded them, and sent them with app and module metadata to command-and-control servers.
- Ledger variants used injected libraries or modified React Native code; phishing screens imitated the app and could validate BIP-39 phrases and offer autocomplete.
- Researchers also found infected Android wallet builds distributed through phishing pages; some samples contained inactive SparkKitty modules, suggesting a possible link between the campaigns.
- The apps primarily targeted users in China, but researchers said some variants had no built-in regional restrictions.
Article Details
- Attack Vectors
- Phishing apps in the Chinese App Store mimicked popular crypto wallets and redirected users to browser pages hosting trojanized wallet installers.
- Typosquatting, copied wallet branding, and functional-looking app stubs helped the phishing apps appear legitimate.
- Infected iOS and Android wallet builds were distributed through phishing pages and iOS provisioning-profile installers.
- Malicious dylib injection and React Native source-code tampering intercepted wallet restore flows and captured recovery phrases.
- Ledger-themed phishing screens prompted users to enter recovery phrases, which the malware encrypted and sent to C2 servers.
- Defensive Notes
- Researchers reported the phishing apps to Apple; several had been removed from the App Store.
- Kaspersky products detect the threat as HEUR:Trojan-PSW.IphoneOS.FakeWallet.* and HEUR:Trojan.IphoneOS.FakeWallet.*.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 114721fbc23ff9d188535bd736a0d30e | Hash of a malicious Android file distributed in this activity. |
| MD5 | 19733e0dfa804e3676f97eff90f2e467 | Hash of the phishing HTML file for the infected Ledger Live app. |
| MD5 | 4126348d783393dd85ede3468e48405d | Hash of an infected crypto-wallet IPA file. |
| MD5 | 5bdae6cb778d002c806bb7ed130985f3 | Hash of a malicious dylib used in the FakeWallet activity. |
| MD5 | 79fe383f0963ae741193989c12aefacc | Hash of an infected crypto-wallet IPA file. |
| MD5 | 7b4c61ff418f6fe80cf8adb474278311 | Hash of a malicious dylib used in the FakeWallet activity. |
| MD5 | 7e678ca2f01dc853e85d13924e6c8a45 | Hash of an infected crypto-wallet IPA file. |
| MD5 | 84c81a5e49291fe60eb9f5c1e2ac184b | Hash of a malicious React Native application. |
| MD5 | 8cbd34393d1d54a90be3c2b53d8fc17a | Hash of a malicious dylib used in the FakeWallet activity. |
| MD5 | 8d45a67b648d2cb46292ff5041a5dd44 | Hash of an infected crypto-wallet IPA file. |
| MD5 | 8f51f82393c6467f9392fb9eb46f9301 | Hash of a malicious Android file distributed in this activity. |
| MD5 | b639f7f81a8faca9c62fd227fef5e28c | Hash of an infected crypto-wallet IPA file. |
| MD5 | bafba3d044a4f674fc9edc67ef6b8a6b | Hash of an infected crypto-wallet IPA file. |
| MD5 | be9e0d516f59ae57f5553bcc3cf296d1 | Hash of a malicious dylib used in the FakeWallet activity. |
| MD5 | d138a63436b4dd8c5a55d184e025ef99 | Hash of a malicious dylib used in the FakeWallet activity. |
| MD5 | d48b580718b0e1617afc1dec028e9059 | Hash of an infected crypto-wallet IPA file. |
| MD5 | fd0dc5d4bba740c7b4cc78c4b19a5840 | Hash of a malicious dylib used in the FakeWallet activity. |
| URL | hxxps[:]//139[.]180[.]139[.]209/prod-api/system/confData/getUserConfByKey/ | Direct-hosted resource listed as a link used in the malicious distribution activity. |
| URL | hxxps[:]//6688cf[.]jhxrpbgq[.]com/6axqkwuq | Malicious download link listed for distributing infected wallet builds. |
| URL | hxxps[:]//api[.]dc1637[.]xyz | Listed as a C2 address associated with the FakeWallet activity. |
| URL | hxxps[:]//appstoreios[.]com/DjZH?key=646556306F6Q465O313L737N3332939Y353I830F31 | Malicious download link listed for distributing infected wallet builds. |
| URL | hxxps[:]//crypto-stroe[.]cc/ | Phishing site listed among links distributing infected wallet builds. |
| URL | hxxps[:]//helllo2025[.]com/api/open/postByTokenpocket | C2 endpoint used to receive exfiltrated wallet recovery phrases. |
| URL | hxxps[:]//iosfc[.]com/ledger/ios/Rsakeycatch.php | Ledger implant C2 endpoint for exfiltrating encrypted recovery phrases. |
| URL | hxxps[:]//kkkhhhnnn[.]com/api/open/postByTokenpocket | C2 endpoint used to receive exfiltrated wallet recovery phrases. |
| URL | hxxps[:]//nmu8n[.]com/tpocket/ios/Rsakeyword.php | C2 endpoint used to receive exfiltrated wallet recovery phrases. |
| URL | hxxps[:]//sxsfcc[.]com/api/open/postByTokenpocket | C2 endpoint used to receive exfiltrated wallet recovery phrases. |
| URL | hxxps[:]//www[.]gxzhrc[.]cn/download/ | Phishing download page used to distribute infected wallet builds. |
| URL | hxxps[:]//yjzhengruol[.]com/s/3f605f | Malicious download link listed for distributing infected wallet builds. |
| URL | hxxps[:]//zmx6f[.]com/btp/ios/receiRsakeyword.php | C2 endpoint used to receive exfiltrated wallet recovery phrases. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelCaptured recovery phrases were encrypted, Base64-encoded, and transmitted to the malware's C2 server.T1071.001 · Web ProtocolsThe malware sent encrypted recovery-phrase data and metadata to C2 endpoints through HTTP POST requests.T1105 · Ingress Tool TransferInfected wallet builds were delivered through browser links and iOS provisioning-profile installers.T1566 · PhishingPhishing App Store listings and browser pages impersonated legitimate wallet distribution pages to trick users into installing trojanized wallets and entering recovery phrases.T1574 · Hijack Execution FlowThe malware injected load commands to load malicious dylibs and used a custom __hook section to intercept wallet methods and recovery-phrase flows.
Malware
Vendors
Products
BitpieResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.CoinbaseResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.imTokenResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.LedgerResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.Ledger LiveApp Store search results for “Ledger Wallet” (formerly Ledger Live)MetaMaskResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.TokenPocketResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.Trust WalletResearchers found 26 phishing apps in the Chinese App Store masquerading as major wallets (MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie) that redirect users to trojanized wallet installers.