Loading story…
Security research warned that mobile cryptocurrency wallets embedding decentralized applications through WebViews can expose users to serious trust-boundary failures, particularly in apps built with React Native and react-native-webview. The report identified three major bug classes: trusted UI spoofing, origin spoofing on the app-to-web communication bridge, and bridge-response interception caused by navigation race conditions. Researchers said these weaknesses can let malicious content appear trustworthy inside the wallet while interacting with privileged wallet functions.
The findings showed that wallet developers using WebViews must recreate browser security controls themselves, including reliable URL display, explicit confirmation prompts, and strict origin validation for messages crossing between untrusted web content and trusted native code. The research also warned that iframe access to bridge interfaces on both Android and iOS can allow malicious child frames to impersonate trusted sites and send requests to the wallet, creating a direct path to unauthorized actions and potential loss of user funds.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Zellic published research describing common security pitfalls in mobile crypto wallet apps that embed dApps through WebViews, including trusted UI spoofing, origin spoofing on communication bridges, and bridge-response interception via navigation race conditions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026
Apache disclosed **CVE-2026-47430**, an important-severity vulnerability in the iOS implementation of `cordova-plugin-inappbrowser` that allows web content loaded inside an InAppBrowser `WebView` to dispatch arbitrary Cordova callback IDs without validation. The flaw stems from a crafted `id` field in a `WKScriptMessage` being passed into Cordova’s command handling, enabling untrusted content to trigger pending callbacks that should belong to other parts of the host app. Because Cordova callback IDs are predictable, a remote attacker controlling displayed content or intercepting traffic could enumerate identifiers and spoof results for other installed plugins, including Camera, Contacts, File, and Geolocation. Reported by Niklas Merz and tracked as issue `#1152`, the bug affects `cordova-plugin-inappbrowser` versions **3.1.0 through 6.0.0** on iOS; Apache fixed it in **6.0.1**, and exploitation scenarios may include malicious webpages, OAuth redirect flows, or deep links viewed inside affected apps.
Jun 29, 2026
Chromium fixed **CVE-2026-95355**, a privilege-escalation flaw in iOS Chromium's `CRWWKNavigationHandler`. An attacker that had already achieved renderer code execution could forge navigation to the bundled `error_page_loaded.html` file, making the browser treat attacker-controlled content as a trusted local error page. The trusted error-page state could then allow navigation to a privileged `chrome://` WebUI URL and expose native WebUI bindings to the compromised renderer, enabling a sandbox escape. Chromium addressed the issue on August 21, 2026, in commit `bb617c8b09d43ed4d617d0c2b6769899324c9ee8` by validating error-page navigations against browser-side state and restricting navigations from committed error pages; the fix was targeted for M154 release notes.
Sep 23, 2026