CampaignPublished 20 Jun 2025Updated 20 Jul 2025

Crypto Phishing Applications On The Play Store

Source AlienVault OTX General

Description

An investigation uncovered more than 20 cryptocurrency phishing applications on the Google Play Store impersonating legitimate wallets like SushiSwap and PancakeSwap. These malicious apps employ phishing techniques to steal users' mnemonic phrases, allowing access to real wallets and theft of funds. The apps share common patterns, including embedded C&C URLs in privacy policies and similar package names. They are distributed through compromised developer accounts previously used for legitimate apps. Two main types were identified: those using the Median framework and those directly loading phishing URLs into WebViews. The campaign demonstrates a coordinated operation with a large-scale phishing infrastructure linked to over 50 domains.

Impact

For European organizations, particularly those involved in cryptocurrency trading, fintech, or blockchain services, this campaign represents a direct financial threat to employees and customers using Android devices. The theft of mnemonic phrases can lead to irreversible loss of cryptocurrency assets, impacting both personal and corporate wallets. Organizations that provide crypto-related services or custody solutions may face reputational damage if their users fall victim to these phishing apps. Additionally, the presence of such apps on the official Google Play Store undermines user trust in app distribution platforms, potentially affecting adoption rates of legitimate crypto applications in Europe. The campaign could also indirectly impact European financial institutions that have exposure to cryptocurrency markets through investment or client holdings. Given the decentralized and irreversible nature of cryptocurrency transactions, stolen funds are unlikely to be recovered, amplifying the financial impact. Furthermore, the use of compromised developer accounts indicates a potential supply chain risk, where legitimate app developers could be targeted and their accounts hijacked, increasing the attack surface for European users. The threat also highlights the challenge of detecting phishing attacks embedded within mobile apps, which may bypass traditional email or web-based phishing defenses commonly deployed in European enterprises.

Defensive guidance

European organizations and users should implement several targeted mitigations beyond generic advice: 1) Enforce strict mobile device management (MDM) policies that restrict installation of apps to verified developers and use app reputation services to detect suspicious apps, especially those mimicking crypto wallets. 2) Educate employees and customers about the risks of entering mnemonic phrases into any app or webpage, emphasizing that legitimate wallets never request seed phrases outside of secure wallet setup or recovery processes. 3) Monitor and audit developer accounts associated with corporate or partner apps to detect unauthorized access or suspicious publishing activity, and promptly revoke compromised credentials. 4) Collaborate with Google and security researchers to report and expedite removal of phishing apps, and encourage the use of Google Play Protect and other app scanning tools. 5) Deploy endpoint protection solutions capable of analyzing app behavior, including WebView content, to detect embedded phishing URLs or suspicious network communications. 6) Encourage the use of hardware wallets or multi-factor authentication mechanisms for accessing cryptocurrency assets to reduce reliance on mnemonic phrases alone. 7) For organizations offering crypto services, implement transaction monitoring and anomaly detection to identify potentially fraudulent transfers resulting from compromised credentials. 8) Maintain updated threat intelligence feeds to track emerging phishing domains and infrastructure linked to this campaign and block them at network perimeters.

Indicators of compromise

Domains 33

aerodromeaz.sbs
aerodromesblogs.site
bitunixflo.sbs
bravebn.sbs
bubblemapsblogs.sbs
bullxni.sbs
cetusdi.sbs
cryptoknowledge.click
harvestfin.sbs
hyperliqw.sbs

IP addresses 1

94.156.177.209

Hashes 6

b2e6fd5f9662c4215f89240c8c960977
b703efe31690b6f84676e795d33f6283
265970e7f8f5c9618ffc215c7612eff4fe97f20a
f288c626be0ba452e098d11b207867793522373c
4aa3659c50616d21ef0bda1389cba1ad3fe768b9dd25eee09289ece97cd3623f
4b35a1ed93ab68f0401de34d4eb5dbb582465ee2a8428e16d0beac8bf87a09af

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jun 2025, 13:07 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

Domains 33

IP addresses 1

Hashes 6

Community reviews

Related threats