Minacce · 158 giorni fa
The App Store is being used as a distribution layer for wallet theft. The standard defense is to trust Apple’s review and then focus on the wallet app itself. That misses the real break: the app can hand users off to a browser page that delivers a trojanized wallet and steals the recovery phrase or private key before the user realizes anything is wrong.
Researchers found more than twenty phishing apps in the Apple App Store posing as crypto wallets. The campaign targets MetaMask, Coinbase Wallet, Trust Wallet, TokenPocket, Bitpie, imToken, and OneKey, and metadata suggests it has been active since at least fall 2025. Kaspersky says the fake apps redirect users to lookalike browser pages and that the same theft pattern has resurfaced with new malicious modules and updated injection techniques.
The risk persists even if the App Store app is removed. Once a recovery phrase or private key is exposed, the attacker can move the wallet outside the victim’s control, and the distribution trick gives the campaign a way to scale past Apple’s normal protections.
4 fonti che coprono questa storia
26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases
26 FakeWallet apps since fall 2025 hijack crypto recovery phrases via Apple App Store China accounts, enabling wallet theft.
Dozens of Malicious Crypto Apps Land in Apple App Store
Masquerading as popular cryptocurrency wallets, the apps can hijack recovery phrases and private keys.
China's Apple App Store infiltrated by crypto-stealing wallet apps
A set of 26 malicious apps on Apple App Store impersonate popular wallets, such as Metamask, Coinbase, Trust Wallet, and OneKey, to steal recovery or seed phrases and drain them of cryptocurrency assets.
FakeWallet cryptostealer propagating via iOS App Store applications
In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets.
FakeWallet crypto stealer spreading through iOS apps in the App Store
In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets.
Part of the PlainSec briefing for 2026-04-25