News

Security analysts have identified a cluster of deceptive applications available on Apple’s App Store that impersonate well-known cryptocurrency wallets and appear to have been active since at least fall 2025. The apps are engineered to capture users’ recovery phrases and private keys, enabling theft of digital assets.

According to Kaspersky researcher Sergey Puzan, once a user opens one of these fraudulent programs it redirects them to a web page crafted to resemble the App Store and then pushes trojanized builds of legitimate wallet software. The compromised apps are purpose-built to intercept mnemonic phrases and private keys from victims.

Kaspersky has labeled the group of 26 malicious titles “FakeWallet.” The impostors imitate many popular wallets including Bitpie, Coinbase, imToken, Ledger, MetaMask, TokenPocket and Trust Wallet. After Kaspersky disclosed their findings, Apple removed numerous samples from the store. So far, investigators have found no indication that these malicious wallet apps were distributed through the Google Play Store.

These FakeWallet samples improve on older iOS crypto scams that relied on dodgy websites and iOS provisioning profiles. Notably, several of the fake apps were available directly in the App Store for users whose Apple account region was set to China. The impostors use icons that closely resemble the authentic wallets and intentionally misspell names - for example, “LeddgerNew” - to trick people into downloading them.

In other cases the apps do not overtly present as crypto tools. Instead, they masquerade under unrelated names and icons, acting as conduits that claim the real wallet is “unavailable in the App Store” for regulatory reasons and guiding users toward installing the genuine wallet via the malicious intermediary.

Kaspersky also found additional apps likely tied to the same operator that currently lack active malicious functionality. Those decoys imitate harmless utilities - such as a game, a calculator or a task planner - but when run they open a web link and leverage enterprise provisioning profiles to install a wallet application on the victim’s device.

Investigators observed that the threat actor has produced many distinct malicious modules tailored to specific wallet implementations. In the majority of cases the malware is introduced by injecting a rogue library into an otherwise legitimate app; in other builds the attackers altered the app’s original source code to implant their payloads.

The attackers’ ultimate objective is to locate mnemonic seed phrases from both hot and cold wallets and send them to a remote server, enabling unauthorized access to users’ wallets and the subsequent draining of funds or execution of fraudulent transactions.

Seed phrases are exfiltrated either by hooking the code responsible for the screen where a user types their recovery phrase or by presenting a phishing webpage that instructs victims to enter their mnemonics under the guise of an account verification step.

Researchers suspect a link between this FakeWallet campaign and last year’s SparkKitty trojan activity. Some infected apps include an optical character recognition (OCR) module for stealing wallet recovery phrases, and both operations exhibit linguistic traces of native Chinese speakers and a targeted focus on cryptocurrency assets.

Kaspersky warns that the FakeWallet operation is evolving: attackers are adopting new delivery vectors, from publishing phishing apps directly in the App Store to embedding into cold-wallet ecosystems and leveraging sophisticated phishing notifications to coax users into revealing their seed phrases.

Separately, security firm Cyble has disclosed an advanced Android malware distribution framework called MiningDropper (also tracked as BeatBanker). This modular toolkit blends cryptocurrency mining with data-stealing, remote-access, and banking malware components and has been observed targeting victims in India as well as regions across Latin America, Europe and Asia as part of a broader BTMOB RAT campaign.

Cyble reports that operators have pushed MiningDropper via a trojanized version of the open-source Android project Lumolight and spread it through fraudulent websites impersonating banks and regional transport authorities. When executed, the malicious package launches a staged process that extracts both the mining component and additional trojan payloads from an encrypted assets archive embedded in the installer.

Technical analysis from Cyble shows that MiningDropper uses a multi-stage delivery architecture that complicates inspection: native code obfuscated with XOR, AES-encrypted payload staging, dynamic loading of DEX modules, and anti-emulation protections are all part of the chain. This layered, modular arrangement hampers static analysis while allowing attackers to reuse the same distribution framework across numerous samples and adapt the final payload for different monetization goals.