Cryptocurrency users and enthusiasts are being targeted by malicious actors with fake wallet apps that steal their precious tokens, researchers have found.
Coinbase, MetaMask, TokenPocket, and imToken products are among those affected, with the threat actors hainge created apps seemingly identical to the legitimate ones, but with one key difference - they carry a backdoor that’s capable of stealing people’s security phrases. The security phrase, or secret key, is a string of words used to recover, or load, an existing wallet into the new app.
Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.
Tens of millions of potential targets
People use it when they forget their passwords, install the app on a new endpoint, or otherwise need to load a wallet on a different device.
Being malicious, these apps cannot be found on official app repositories, such as the Play Store or App Store. Instead, the threat actors rely on distributing the app via web pages, which they promote through black SEO techniques, SEO poisoning, social media marketing, forum promotions, malvertising, etc.
The researchers could not say how many people were tricked into downloading these apps, but Coinbase’s app alone has more than 10 million downloads, just on Android.
As for the victims, the attackers seem to be mostly targeting the Asian population. Search results from the Baidu engine have been most impacted by the campaign, as these have been directing “massive amounts” of traffic to the sites that host the malicious apps.
The attackers themselves seem to be Asian, as well. Confiant calls them SeaFlower, and believes them to be Chinese due to subtle hints like the language of the comments in the source code, the location of the infrastructure, and the frameworks and services used.
The campaign seems to have been active since at least March this year, Confiant says, adding that it’s “the most technically sophisticated threat targeting web3 users, right after the infamous Lazarus Group.”
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.