Kaspersky Flags 26 Fake Crypto Wallet Apps That Could Drain Your Funds

These faux iOS apps seem respectable however redirect customers to phishing pages, resulting in malware set up and eventual theft of crypto belongings.

Cybersecurity agency Kaspersky has recognized 26 fraudulent cryptocurrency pockets purposes on Apple’s App Retailer which can be designed to steal customers’ digital belongings.

The corporate’s Risk Analysis group discovered that the apps imitate standard crypto wallets, equivalent to MetaMask, Ledger, Belief Pockets, Coinbase, TokenPocket, imToken, and Bitpie, by copying their names and visible branding to look respectable. As soon as opened, these purposes redirect customers to phishing pages that resemble the App Retailer interface and immediate them to obtain a second utility, which is definitely a trojanized pockets that may drain cryptocurrency funds.

How The Rip-off Works

Kaspersky said the marketing campaign has been energetic since at the least fall 2025 and, with “reasonable confidence,” linked it to the risk actors behind SparkKitty, a beforehand recognized iOS malware pressure. Official variations of many of those pockets apps aren’t accessible within the Chinese language iOS App Retailer; a lot of the detected phishing apps had been distributed particularly to customers in China, although the malicious payload itself doesn’t embody regional restrictions. This primarily signifies that customers exterior China is also affected. Kaspersky confirmed it has reported all recognized apps to Apple.

In line with the findings, the fraudulent apps embody primary, unrelated options equivalent to video games, calculators, or job managers to create an look of legitimacy and move preliminary scrutiny. After set up, they information customers by means of a course of that opens a faux App Retailer webpage and encourages them to obtain what seems to be the supposed pockets utility.

This set up course of works equally to SparkKitty, utilizing Apple’s enterprise developer instruments for company app distribution. Customers are prompted to put in a developer profile on their gadget, which permits them to put in apps from exterior the App Retailer. Attackers depend on customers overlooking this step, enabling the set up of malicious software program.

As soon as put in, the trojanized pockets purposes are designed to imitate the conduct of the precise pockets they impersonate. They aim each cold and hot wallets.

Kaspersky’s cell malware knowledgeable, Sergey Puzan, acknowledged that whereas the apps themselves could not comprise dangerous code, they function entry factors in a broader assault chain that in the end results in malware set up. The researcher additional warned,

You may additionally like:

“By paying a price and establishing a developer account, the attackers can goal any iOS gadget if the consumer succumbs to the phishing tactic. Customers ought to be cautious of the dangers associated to managing their crypto wallets even on units that they think about secure, equivalent to iPhones. We anticipate there could also be extra trojanized crypto apps distributed with an analogous tactic.”

Counterfeit Ledger System

The most recent report comes days after a counterfeit Ledger Nano S Plus gadget offered by means of an internet market was exposed as a part of a complicated phishing operation designed to steal crypto pockets credentials by a Brazilian cybersecurity researcher. The gadget, which was marketed and priced like an official product, initially appeared real however failed verification when linked to Ledger Stay.

Upon opening the gadget, the researcher discovered inside parts that didn’t match respectable {hardware}, together with a chip with its markings eliminated and extra WiFi and Bluetooth antennas not current in genuine Ledger wallets. Additional examination of the firmware revealed that each PIN codes and seed phrases had been saved in plaintext, together with references to exterior servers, indicating that the gadget was designed to seize and transmit delicate information.

The researcher acknowledged that this assault doesn’t contain any flaw in Ledger’s safety, however as a substitute makes use of faux units, dangerous apps, and phishing tips to focus on customers.