Cryptocurrency users and enthusiasts are being targeted by malicious actors with fake wallet apps that steal their precious tokens, researchers have found.
Cybersecurity researchers from Confiant discovered that some of the world’s most popular cryptocurrency wallets are being spoofed by clones (opens in new tab) that carry malware.
Coinbase, MetaMask, TokenPocket, and imToken products are among those affected, with the threat actors hainge created apps seemingly identical to the legitimate ones, but with one key difference – they carry a backdoor that’s capable of stealing people’s security phrases. The security phrase, or secret key, is a string of words used to recover, or load, an existing wallet into the new app.
Tens of millions of potential targets
People use it when they forget their passwords, install the app on a new endpoint, or otherwise need to load a wallet on a different device.
Being malicious, these apps cannot be found on official app repositories, such as the Play Store or App Store. Instead, the threat actors rely on distributing the app via web pages, which they promote through black SEO techniques, SEO poisoning, social media marketing, forum promotions, malvertising, etc.
The researchers could not say how many people were tricked into downloading these apps, but Coinbase’s app alone has more than 10 million downloads, just on Android.
As for the victims, the attackers seem to be mostly targeting the Asian population. Search results from the Baidu engine have been most impacted by the campaign, as these have been directing “massive amounts” of traffic (opens in new tab) to the sites that host the malicious apps.
The attackers themselves seem to be Asian, as well. Confiant calls them SeaFlower, and believes them to be Chinese due to subtle hints like the language of the comments in the source code, the location of the infrastructure, and the frameworks and services used.
The campaign seems to have been active since at least March this year, Confiant says, adding that it’s “the most technically sophisticated threat targeting web3 users, right after the infamous Lazarus Group.”
