AppsFlyer's Web SDK briefly served obfuscated JavaScript that targeted cryptocurrency wallet fields. The code replaced entered wallet addresses with attacker-controlled addresses and exfiltrated originals.
Part of the PlainSec briefing for 2026-03-15