蘋果App Store驚見假錢包，FakeWallet攻擊竊取助記詞

Kaspersky has exposed an attack campaign dubbed FakeWallet, in which at least 26 counterfeit cryptocurrency wallet applications have infiltrated Apple's App Store, predominantly targeting the Chinese regional storefront. The attackers exploit a known gap: many legitimate crypto wallets are unavailable in China's App Store for users with Chinese Apple IDs, creating an opportunity for malicious actors to publish lookalike apps with near-identical icons and names — sometimes with deliberate misspellings — to deceive users into thinking they are downloading official versions.

The fake apps impersonate several major cryptocurrency wallets, including MetaMask, Ledger Live, Trust Wallet, Coinbase Wallet, TokenPocket, imToken, and Bitpie. Rather than functioning as legitimate wallets, these apps serve primarily as entry points that redirect users to phishing pages or prompt them to install malware-laden wallet versions. When users attempt to create or import a wallet, their seed phrases (recovery phrases) and private keys are intercepted and transmitted to attackers, granting full control over the victim's crypto assets. Some variants targeting hardware wallet users display fake 'security verification' screens to trick users into voluntarily entering their seed phrases.

The technical methods employed are varied and sophisticated. Some samples contain injected malicious libraries or tampered source code that intercept seed phrases during app execution. Others exploit iOS configuration profiles to bypass App Store installation restrictions, installing compromised wallets directly onto devices and significantly complicating detection and mitigation efforts.

Kaspersky also identified a potential link between the FakeWallet campaign and a previously known malware strain called SparkKitty, as some samples contained modules from both, along with Chinese-language comments and log messages in the code — suggesting the developers are likely native Chinese speakers. However, researchers caution that attribution to a single threat actor remains unconfirmed.

Despite the campaign's current focus on the Chinese market, Kaspersky warns that the malicious modules contain no regional restrictions, and some phishing interfaces automatically adapt to the user's language, indicating that the attack methodology has the capability to expand into other global markets.