Blockchain security company SlowMist has reported a new security issue affecting Linux users.
Attackers are using trusted apps on the Snap Store to collect crypto wallet recovery phrases and steal funds.
According to SlowMist’s chief information security officer, 23pds, the attackers are taking over Snap Store publisher accounts by registering expired domains. These accounts, once controlled, are then used to push fake updates through official channels.
Did you know?
Subscribe – We publish new crypto explainer videos every week!
What is Olympus DAO? (OHM Crypto Animated Explainer)
The fake apps are made to look like real crypto wallets, including Exodus, Ledger Live, and Trust Wallet.
When users install or update the app, they are asked to enter their wallet recovery phrases. The attackers then capture these details and gain access to the users’ funds.
SlowMist explained that the attackers monitor developer accounts linked to domains that have expired but were once legitimate. Once the domain becomes available, they register it and use email addresses tied to that domain to reset the account password.
After gaining access, the attackers can add harmful code through normal software updates instead of creating new apps, which helps them avoid suspicion.
SlowMist confirmed that two publisher domains, “storewise[.]tech” and “vagueentertainment[.]com”, have already been compromised.
CertiK traced about $63 million in Tornado Cash deposits linked to the $282 million crypto wallet hack on January 10. What did the blockchain security firm say? Read the full story.
