Loading story…
Apple is facing a California federal lawsuit after three customers said they lost a combined $1.8 million in Bitcoin by downloading a fake Sparrow Wallet app from the App Store. The complaint alleges the fraudulent iOS app impersonated the legitimate Sparrow Wallet product—even though the real wallet is not available on iOS—and tricked victims into entering their seed phrases, allowing attackers to transfer cryptocurrency to wallets they controlled.
The lawsuit claims Apple misrepresented the App Store as a safe and trusted marketplace while failing to adequately review, monitor, and remove impersonation apps despite prior public warnings from Sparrow Wallet developer Craig Raw and reports from affected users. Apple said it has since removed the fake apps, terminated the associated developer accounts, and pointed to its existing anti-fraud enforcement measures and reporting channels for scams and intellectual property abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Apple said it removed the fake Sparrow Wallet apps from the App Store and terminated the associated developer accounts. The company cited these actions in response to the allegations over the fraudulent listings.
Three customers allegedly downloaded a fraudulent Sparrow Wallet app from the App Store and lost a combined roughly $1.8 million in Bitcoin. The fake app reportedly tricked victims into entering seed phrases, allowing attackers to transfer cryptocurrency to wallets they controlled.
According to the complaint, Craig Raw tried to submit a placeholder warning app to alert users about the scam, but Apple initially flagged it before later reversing that decision. This was cited as part of Apple's allegedly slow response to the impersonation problem.
Sparrow Wallet developer Craig Raw had publicly warned users about scam versions of Sparrow Wallet appearing in Apple's App Store. The reports noted that Sparrow Wallet is not available on iOS, making the App Store listings fraudulent impersonations.
On 2026-07-24, three plaintiffs filed a lawsuit against Apple in California federal court alleging that inadequate App Store review and monitoring allowed a fake Sparrow Wallet app to steal about $1.8 million in Bitcoin. The complaint argues Apple misrepresented the App Store as a safe and trusted marketplace and responded too slowly to reports of the scam.
The new reference says Sparrow Wallet founder Craig Raw had been warning since early 2024 that Sparrow Wallet had no official mobile application. Despite those warnings, fake Sparrow apps allegedly continued appearing in the App Store through 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcetechrepublic.com
Open sourcebleepingcomputer.com
Open sourcemacrumors.com
Open sourcemacrumors.com
Open sourceapple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious macOS app impersonating **Ledger Live** was distributed through Apple’s App Store and linked to the theft of more than **$9.5 million** in cryptocurrency from over **50 victims**. Investigators said the app used Ledger branding, fake credibility signals, and prompts for users’ seed or recovery phrases, allowing attackers to seize control of wallets and drain assets across multiple networks, including **Bitcoin, Ethereum, Solana, Tron, and XRP**. The fraudulent listing was reportedly published under **Leva Heal Limited** rather than Ledger and showed a suspicious version history that jumped rapidly from `1.0` to `5.0` within roughly two weeks. Blockchain investigator **ZachXBT** traced the stolen funds from intermediary wallets into more than **150 KuCoin deposit addresses**, after which they were laundered through a centralized mixing service known as **AudiA6**. Apple removed the app after user reports, and KuCoin said it froze the implicated accounts pending possible law enforcement action. The thefts, reported over a span of days in April, have intensified scrutiny of Apple’s app review process and underscored the continuing risk of fake wallet and financial apps appearing in trusted software marketplaces.
Jun 29, 2026
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026
A phishing campaign targeting **Apple Pay** users is using realistic-looking emails to push victims into calling a fraudulent “Apple Support” phone number, shifting the attack from link-clicking to **vishing** (voice phishing). The lure commonly claims a high-value Apple Store charge was attempted or stopped, and includes plausible details (e.g., **case ID**, timestamp, and an “appointment” to review the activity) to create urgency and legitimacy. Malwarebytes reported the operation’s objective is to extract **login/verification codes** and **payment data** during the phone interaction, enabling attackers to take over the victim’s Apple account and potentially access associated data and linked payment methods. Follow-on reporting highlighted the use of Apple branding and invoice-style formatting (including high-ticket purchase claims) to increase conversion, and emphasized the potential impact of account compromise beyond payment theft (e.g., access to stored personal data and connected services).
Jun 30, 2026