Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An investigation uncovered more than 20 cryptocurrency phishing applications on the Google Play Store impersonating legitimate wallets like SushiSwap and PancakeSwap. These malicious apps employ phishing techniques to steal users' mnemonic phrases, allowing access to real wallets and theft of funds. The apps share common patterns, including embedded C&C URLs in privacy policies and similar package names. They are distributed through compromised developer accounts previously used for legitimate apps. Two main types were identified: those using the Median framework and those directly loading phishing URLs into WebViews. The campaign demonstrates a coordinated operation with a large-scale phishing infrastructure linked to over 50 domains.

This threat involves a coordinated campaign distributing over 20 malicious cryptocurrency phishing applications on the Google Play Store. These apps impersonate legitimate decentralized finance (DeFi) wallet applications such as SushiSwap and PancakeSwap, which are popular platforms for cryptocurrency trading and liquidity provision. The malicious applications employ phishing techniques aimed at stealing users' mnemonic seed phrases — critical credentials that provide full access to cryptocurrency wallets. By capturing these phrases, attackers can gain unauthorized access to victims' wallets and steal their funds. The campaign is notable for its use of compromised developer accounts that were previously used to publish legitimate apps, allowing the malicious apps to bypass some of Google's app vetting processes. Two primary technical approaches were identified: one group of apps uses the Median framework, a known tool for building phishing apps, while the other group loads phishing URLs directly into embedded WebViews within the app, effectively presenting fake login or seed phrase input pages to users. The apps share common characteristics such as similar package names and embedded command and control (C&C) URLs hidden within privacy policy documents, indicating a well-organized infrastructure. The campaign is linked to a large-scale phishing infrastructure involving over 50 domains, suggesting a broad and persistent operation. Although no known exploits in the wild have been reported beyond this campaign, the threat poses a significant risk to cryptocurrency users relying on Android devices and the Google Play ecosystem. The attack leverages social engineering and app impersonation rather than exploiting software vulnerabilities, making it harder to detect by traditional antivirus or signature-based defenses.

Detailed information about Crypto Phishing Applications On The Play Store. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'median framework'

Filter Threats

Threats Tagged 'median framework'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility