AppsFlyer Web SDK hijacked to deliver crypto-stealing JavaScript
Summary
AppsFlyer confirmed a domain registrar incident temporarily exposed some customer websites using its Web SDK to unauthorized JavaScript that could replace cryptocurrency wallet addresses. The scope remains under investigation.
Key points
- Profero reported finding obfuscated attacker-controlled JavaScript served through the AppsFlyer Web SDK on March 9.
- The script monitored for cryptocurrency wallet inputs and could replace addresses with attacker-controlled ones while exfiltrating the originals and related metadata.
- The reported targets included Bitcoin, Ethereum, Solana, Ripple, and TRON addresses.
- Profero estimated the exposure window ran from March 9 at 22:45 UTC to March 11; the full scope and root cause remain unverified.
- AppsFlyer confirmed unauthorized code was delivered to a segment of customer websites, said its mobile SDK was unaffected, and reported no evidence that customer data on its systems was accessed.
- AppsFlyer said the issue was resolved and its investigation with external forensic experts is ongoing; the article recommends reviewing telemetry, reverting to known-good SDK versions, and investigating potential compromise.
Article Details
- Victim Organization
- AppsFlyer
- Victim Domain
- websdk.appsflyer.com
- Incident Type
- Supply-chain compromise involving unauthorized JavaScript delivered through the AppsFlyer Web SDK. The code could replace cryptocurrency wallet addresses and exfiltrate the original addresses and associated metadata.
- Incident Date
- 2026-03-09
- Disclosure Date
- 2026-03-10
- Data Types Exposed
- Cryptocurrency wallet addresses and associated metadata (the payload was designed to exfiltrate them; actual collection is unverified)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Unauthorized code was delivered to a segment of customer websites using the Web SDK. The payload could substitute attacker-controlled wallet addresses and potentially divert cryptocurrency payments; actual financial losses are not reported. AppsFlyer said the issue was resolved, the mobile SDK was unaffected, and its investigation had not identified evidence that customer data on AppsFlyer systems was accessed.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | websdk[.]appsflyer[.]com | AppsFlyer’s Web SDK hostname temporarily delivered unauthorized code during the reported domain registrar incident. |
Threat Actors
Vendors
Products
AppsFlyer Web SDKThe AppsFlyer Web SDK was temporarily hijacked to deliver obfuscated attacker-controlled JavaScript that intercepted and replaced cryptocurrency wallet addresses to divert funds.mobile SDKAppsFlyer confirmed a domain registrar incident on March 10, stated the mobile SDK was unaffected, and said investigations with external forensics are ongoing.