Malware

FakeWallet

FakeWallet is a cryptocurrency-focused mobile malware campaign centered on trojanized wallet applications that impersonate legitimate crypto wallet brands in order to steal recovery phrases, private keys, and related wallet secrets. It has been identified on both Android and iOS, with notable activity involving fake wallet apps distributed through counterfeit websites and, in later activity, phishing applications placed in Apple’s App Store that redirected users to malicious installation flows. The operation has primarily targeted cryptocurrency users in China, exploiting the limited availability of some legitimate wallet applications in that market, but the malware’s functionality is not inherently region-locked.

On Android, FakeWallet has appeared as repackaged versions of legitimate wallet applications with malicious code inserted into wallet creation or import workflows so seed phrases can be captured and exfiltrated while the app retains expected wallet functionality. On iOS, observed variants have used multiple techniques, including malicious dynamic library injection, executable hooking, and direct modification of application source code, to intercept wallet restoration and recovery-phrase display flows. Some Ledger-focused variants relied on in-app phishing and fake verification screens rather than direct extraction, reflecting the different security model of cold-wallet companion applications.

The malware’s core objective is crypto-theft through credential and secret capture. Observed behaviors include scraping mnemonic phrases from wallet user interfaces, intercepting recovery workflows, collecting private keys, and exfiltrating stolen data to attacker-controlled infrastructure. Some variants encrypted captured mnemonics before transmission. Researchers have also documented fake wallet applications that simply solicit recovery phrases from victims without providing legitimate wallet functionality.

Distribution has relied on phishing-style impersonation of well-known wallet brands, typosquatting, fake promotional pages, counterfeit app-store experiences, and malicious or trojanized wallet installers. Earlier activity included dozens of fake websites promoting malicious Android and iOS wallet apps and affiliate-style recruitment of distributors. Later iOS-focused activity used benign-looking App Store stubs such as utility or game apps that redirected users to malicious pages and abused provisioning profiles to install infected wallet applications outside normal store controls.

FakeWallet is commonly classified by vendors as a mobile trojan or password-stealing trojan targeting cryptocurrency wallet secrets. Reporting has also noted possible overlap with SparkKitty in some iOS samples based on shared modules and tradecraft, although that linkage has been assessed rather than conclusively established.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598Phishing for InformationEvidence2

The verify.html phishing page prompts the user to enter their mnemonics... designed to match the app’s style and even supports autocomplete for mnemonics to project quality.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

However, once you launched the app, it would open a malicious link in your browser. This link kicks off a scheme leveraging provisioning profiles to install infected versions of crypto wallets onto the victim’s device.

T1566PhishingEvidence3

Opening each of the 26 fraudulent crypto wallet apps, all of which have since been removed by Apple, diverts to phishing pages impersonating legitimate crypto service portals that trick targets into downloading malicious wallet apps through iOS provisioning profiles

Execution

3 techniques

T1204.002Malicious FileEvidence1

...trick targets into downloading malicious wallet apps through iOS provisioning profiles, a technique evident in the SparkKitty campaign

T1574Hijack Execution FlowEvidence2

In most cases, the malware is delivered via a malicious library injection... To embed the malicious library, the hackers injected load commands into the main executable... then swaps out legitimate class methods for malicious versions.

T1574.006Dynamic Linker HijackingEvidence1

In most cases, the malware is delivered via a malicious library injection... To embed the malicious library, the hackers injected load commands into the main executable.

Persistence

1 technique

T1556Modify Authentication ProcessEvidence1

It hijacks the original viewDidLoad method within the RecoveryPhraseViewController class, the part of the code responsible for the screen where the user enters their recovery phrase.

Privilege Escalation

1 technique

T1548.005Temporary Elevated Cloud AccessEvidence1

By abusing iOS provisioning profiles to install malware, attackers were able to steal recovery phrases from major hot wallets

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

This string is encrypted using RSA with the PKCS #1 scheme. The encrypted data is then encoded into Base64.

T1036MasqueradingEvidence3

More than two dozen Apple App Store apps spoofing well-known cryptocurrency wallets Coinbase, Metamask, OneKey, and Trust Wallet, have been leveraged to pilfer seed phrases

T1070Indicator RemovalEvidence1

Then the clearPendingMnemonicJob function replaces the contents of the file with an empty JSON dictionary.

T1574Hijack Execution FlowEvidence2

T1574.006Dynamic Linker HijackingEvidence1

In most cases, the malware is delivered via a malicious library injection... To embed the malicious library, the hackers injected load commands into the main executable.

T1622Debugger EvasionEvidence1

This same logic is preserved in the infected version, effectively serving as an anti-debugging technique: the phishing window only appears during a realistic usage scenario.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

It hijacks the original viewDidLoad method within the RecoveryPhraseViewController class, the part of the code responsible for the screen where the user enters their recovery phrase.

Credential Access

3 techniques

T1056Input CaptureEvidence3

Included in the trojanized apps were additional code enabling the mnemonic phrase interception, encryption, and exfiltration.

T1556Modify Authentication ProcessEvidence1

It hijacks the original viewDidLoad method within the RecoveryPhraseViewController class, the part of the code responsible for the screen where the user enters their recovery phrase.

T1649Steal or Forge Authentication CertificatesEvidence1

This link kicks off a scheme leveraging provisioning profiles to install infected versions of crypto wallets onto the victim’s device.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

the malware traverses the view controller hierarchy and searches for a child screen named add-account-cta or one containing a $ sign in its name

T1622Debugger EvasionEvidence1

This same logic is preserved in the infected version, effectively serving as an anti-debugging technique: the phishing window only appears during a realistic usage scenario.

Collection

2 techniques

T1056Input CaptureEvidence3

Included in the trojanized apps were additional code enabling the mnemonic phrase interception, encryption, and exfiltration.

T1074Data StagedEvidence1

verify-wallet-pending.json holds encrypted mnemonics until they’re successfully transmitted to the C2 server.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

The POST request used to exfiltrate those encrypted mnemonics looks like this: POST < c2_domain > / api / open / postByTokenPocket ? ciyu = < base64_encoded_encrypted_mnemonics >

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

Included in the trojanized apps were additional code enabling the mnemonic phrase interception, encryption, and exfiltration.

INDICATORS OF COMPROMISE

IOCs tracked for this family

74 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

23 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

21 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

30 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app14 days ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

microsoft generalNews

May 17, 2022

In hot pursuit of ‘cryware’: Defending hot wallets from attacks | Microsoft Security Blog

Android trojan family listed in detections appendix, associated by name with fake wallet applications.

microsoft generalNews

May 17, 2022

In hot pursuit of ‘cryware’: Defending hot wallets from attacks | Microsoft Security Blog

Mentioned only as an Android trojan detection name in the appendix, likely referring to fake wallet malware.

eset welivesecurity blogNews

Mar 24, 2022

Crypto malware in patched wallets targeting Android and iOS devices

A trojanized mobile cryptocurrency wallet threat affecting Android and iOS. Attackers repackage legitimate wallet apps such as Trust Wallet, Bitpie, OneKey, MetaMask, imToken, Coinbase Wallet, and TokenPocket, inject malicious code, and exfiltrate victims’ wallet seed phrases to attacker-controlled servers. Some variants transmit the seed phrase over unsecured HTTP.

securelistNews

May 13, 2021

FakeWallet crypto stealer spreading in the App Store | Securelist

A crypto-wallet trojan campaign distributed via phishing apps in the Apple App Store and phishing sites. It trojanizes legitimate wallet apps, injects malicious libraries or modifies app code, steals recovery phrases/private keys, encrypts the data, and exfiltrates it to attacker-controlled C2 servers.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching74

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FakeWallet