Over Two Dozen Fake Crypto Wallet Apps Stealing Seed Phrases on Play Store

2025-06-15 18:36:00

Crypto Wallets Targeted: The scam Exposed

Over 20 malicious apps on the Google Play Store where designed to steal users’ cryptocurrency. These apps tricked users into giving up their 12-word recovery phrases, giving hackers full access to their wallets.

• Fake apps mimicked legitimate crypto wallet tools.
• Users were tricked into entering their private keys.
• Once compromised, victims faced complete loss of their crypto.

Cybersecurity researchers have discovered a widespread phishing campaign preying on cryptocurrency users. More than 20 Android apps, available on the Google Play Store, were created wiht the sole purpose of stealing users’ crypto credentials. The apps looked like legitimate wallet tools. The scheme centered around obtaining users’ 12-word mnemonic phrases, which unlock their digital wallets.

How the Apps Worked

Many of the malicious apps used the Median framework. This allows for the quick conversion of websites into Android applications. Threat actors embedded phishing URLs directly into the app code or within privacy policy documents. These links then loaded deceptive login pages using a WebView.

This method tricked users into entering their recovery phrases, believing they were interacting with trusted services such as PancakeSwap, SushiSwap, Raydium, and Hyperliquid. For example, a fake PancakeSwap app used a URL that led to a phishing page mimicking the legitimate PancakeSwap interface.

Reader question: What security measures do you take to protect your crypto wallets from phishing attacks?

A fake Raydium app redirected users to a similar scam. The apps had a common goal: to steal users’ private access keys. The phishing infrastructure supporting these apps was extensive. One IP address used to host these malicious pages was linked to over 50 other phishing domains.

Did you know? Phishing domains often mimic well-known crypto platforms to lure victims.

These domains imitated popular crypto platforms and were reused across multiple apps, indicating a well-resourced operation. some malicious apps were published under developer accounts previously associated with legitimate software, such as gaming or streaming applications, making them harder to detect.

Staying Safe: Protecting Your Crypto

To avoid these attacks, only download apps from verified developers. Avoid any apps that request sensitive details. Using reputable Android antivirus or endpoint protection software, and ensuring that google Play Protect is enabled, is important. Strong, unique passwords and multi-factor authentication should be standard practice. Also, enable biometric security features when available.

pro tip: Always double-check the URL of any website asking for your private keys. Look for subtle misspellings or unusual domain extensions.

Avoid clicking suspicious links received via SMS or email and never enter sensitive information into mobile apps unless certain of their legitimacy. No legitimate app should ever ask for your full mnemonic phrase through a login prompt.

What should I do if I think my crypto wallet is compromised? If you suspect your wallet has been compromised, immediately transfer your funds to a new, secure wallet and change all relevant passwords. Contacting your crypto exchange or wallet provider for support is also a good idea.

Full List of Fake Apps to Avoid

• 1. Pancake SwapPackage: co.median.android.pkmxaj
  privacy Policy: hxxps://pancakefentfloyd.cz/privatepolicy.html
• 2. Suiet Walletpackage: co.median.android.ljqjry
  Privacy Policy: hxxps://suietsiz.cz/privatepolicy.html
• 3. HyperliquidPackage: co.median.android.jroylx
  Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html
• 4. RaydiumPackage: co.median.android.yakmje
  Privacy Policy: hxxps://raydifloyd.cz/privatepolicy.html
• 5. HyperliquidPackage: co.median.android.aaxblp
  Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html
• 6. BullX CryptoPackage: co.median.android.ozjwka
  Privacy Policy: hxxps://bullxni.sbs/privatepolicy.html
• 7. OpenOcean ExchangePackage: co.median.android.ozjjkx
  Privacy Policy: hxxps://openoceansi.sbs/privatepolicy.html
• 8. Suiet WalletPackage: co.median.android.mpeaaw
  privacy Policy: hxxps://suietsiz.cz/privatepolicy.html
• 9. meteora ExchangePackage: co.median.android.kbxqaj
  Privacy Policy: hxxps://meteorafloydoverdose.sbs/privatepolicy.html
• 10. RaydiumPackage: co.median.android.epwzyq
  Privacy Policy: hxxps://raydifloyd.cz/privatepolicy.html
• 11. SushiSwapPackage: co.median.android.pkezyz
  Privacy Policy: hxxps://sushijames.sbs/privatepolicy.html
• 12. RaydiumPackage: co.median.android.pkzylr
  Privacy Policy: hxxps://raydifloyd.cz/privatepolicy.html
• 13.sushiswapPackage: co.median.android.brlljb
  Privacy Policy: hxxps://sushijames.sbs/privatepolicy.html
• 14. HyperliquidPackage: co.median.android.djerqq
  Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html
• 15. Suiet walletPackage: co.median.android.epeall
  Privacy Policy: hxxps://suietwz.sbs/privatepolicy.html
• 16. BullX cryptoPackage: co.median.android.braqdy
  Privacy Policy: hxxps://bullxni.sbs/privatepolicy.html
• 17. Harvest Finance blogPackage: co.median.android.ljmeob
  Privacy Policy: hxxps://harvestfin.sbs/privatepolicy.html
• 18. Pancake SwapPackage: co.median.android.djrdyk
  Privacy Policy: hxxps://pancakefentfloyd.cz/privatepolicy.html
• 19.HyperliquidPackage: co.median.android.epbdbn
  Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html
• 20. suiet WalletPackage: co.median.android.noxmdz
  Privacy Policy: hxxps://suietwz.sbs/privatepolicy.html
• 21. RaydiumPackage: cryptoknowledge.rays
  Privacy Policy: hxxps://www.termsfeed.com/live/a4ec5c75-145c-47b3-8b10-d43164f83bfc
• 22. PancakeSwapPackage: com.cryptoknowledge.quizzz
  Privacy Policy: hxxps://www.termsfeed.com/live/a4ec5c75-145c-47b3-8b10-d43164f83bfc

deeper Dive: Decoding the Crypto Phishing Tactics

The recent wave of malicious apps targeting crypto wallets unveils a elegant approach by cybercriminals. they leverage various techniques to deceive users. These attacks aren’t just random; they’re part of a calculated effort to exploit vulnerabilities within the crypto ecosystem.

The goal? To steal your crypto assets, of course. Fraudsters craft these apps to mirror trusted platforms like PancakeSwap, making it hard to tell the difference. Understanding the tactics helps bolster your defenses.

Beyond the apps themselves, the attackers capitalize on human trust. Remember that these malicious actors are always looking for clever ways to trick you.

The Anatomy of a Crypto Phishing Attack

Let’s break down the mechanics of these attacks, step by step:

1. The Hook: Attackers create fake apps that mimic popular crypto platforms. They’re available on app stores, ready to be downloaded.
2. The Bait: The apps prompt users to enter their 12-word recovery phrase or other sensitive details. This information is the key to your wallet.
3. The Catch: Once the user enters their phrase, the attackers gain access to the crypto wallet. Cryptocurrency is then transferred to the criminals’ accounts.
4. The Payoff: Attackers quickly move funds while the victims can do nothing.

the use of the Median framework suggests a streamlined process. This allowed attackers to swiftly deploy numerous apps. They could quickly adapt to evade detection.

Benefits & Practical Tips: Fortifying Your Crypto Defenses

Protecting yourself from these attacks requires a multi-layered approach. Here’s a practical checklist for enhanced security:

• Verify App Developers: Always check the developer’s reputation before downloading. Look for a well-established history and good reviews.
• Scrutinize Permissions: Review the app’s requested permissions. Be wary of apps asking for excessive access to your device.
• Double-Check urls: Always double-check website addresses for spelling errors. Ensure the site uses HTTPS (secure connection) and is legitimate.
• Avoid Suspicious Links: Never click links from unknown sources,especially via SMS or email.
• Use Strong Passwords & 2FA: Employ strong, unique passwords and enable two-factor authentication (2FA). This adds an extra layer of security.
• Keep Software Updated: Regularly update your device’s operating system and apps. Updates frequently enough include security patches.

By implementing these practices, you significantly minimize your chances of becoming a victim.

Case Study: Real-World Crypto Scams

Take the case of “Bob”. Bob downloaded a seemingly legitimate app of a popular exchange. He entered his recovery phrase, believing it was the real app. Within minutes, Bob’s crypto was stolen. The app was fake. The attacker then quickly moved all the digital assets to untraceable wallets.

Or “Alice.” A phishing email arrived. It looked like it was from her wallet provider.The email prompted her to update her information. Alice, feeling rushed, clicked the link and entered her credentials. Funds were stolen. These examples illustrate why vigilance is critical.

Myths vs. Facts

Let’s dispel some common myths surrounding crypto security.

myth	Fact
“My crypto is safe as long as I have a strong password.”	While strong passwords are crucial, they are not foolproof. Phishing attacks bypass this by tricking you into revealing your credentials.
“All apps on the Google Play Store are safe.”	The Google Play Store, while generally secure, can host malicious apps. Thorough research is crucial,as we’ve already seen.
“Hardware wallets are immune to phishing attacks.”	Hardware wallets provide robust security. However, phishing can still target the details you input, like the 12-word phrase.

Understanding the reality of these threats is key to staying ahead. Always verify information and use multiple layers of protection.

FAQs: Addressing Key Concerns

Here are some frequent questions.They will further enhance your understanding:

What should I do if I accidentally enter my recovery phrase on a phishing site?

Immediately change your wallet’s passwords. Also, transfer all funds to a new, secure wallet. Contact the wallet provider immediately.

Are all crypto apps on official app stores safe?

No. Malicious apps can slip through the security checks. Always research and verify the app before downloading.

How can I tell if a website asking for my recovery phrase is legitimate?

check the URL for misspellings or anything unusual. Always look for the HTTPS on the site before entering any details.

Are there any apps which can guarantee my protection?

no, there is no 100% guarantee. Remain vigilant.