Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

FakeWallet Apple App Store wallet-stealing apps

Malware Activity
First reported
Last updated
Happening score
H score 8
2 unique sources, 2 articles

Summary

Hide ▲

The FakeWallet app set turned the Apple App Store into a delivery channel for 26 malicious wallet lookalikes, putting crypto holders at risk of account takeover and theft. The apps impersonated brands such as Metamask, Coinbase, Trust Wallet, and OneKey, then pushed victims toward phishing pages and trojanized wallet installs. Users in China were the main target, but the design could scale beyond that market if the operators expand distribution.

Related Happenings

OkoBot Windows malware framework with SeedHunter wallet phrase theft

Malware Activity
H score31 First: 15.07.2026 18:30 Last: 15.07.2026 18:30 Sources 1

About this happening: The OkoBot malware framework is actively running on Windows and using SeedHunter to steal hardware wallet recovery phrases, putting wallet owners and endpoint data at...

Open Happening

OkoBot hardware-wallet phrase theft campaign

Campaign
H score37 First: 15.07.2026 18:30 Last: 15.07.2026 18:30 Sources 1

About this happening: An active OkoBot campaign is driving hundreds of victimizations across more than 25 countries, showing broad coordinated malware activity. The operation uses overlapping d...

Open Happening

KU Leuven DistriNet crypto wallet browser-extension privacy leaks and cross-site tracking

Technical Analysis
H score24 First: 14.07.2026 14:55 Last: 14.07.2026 14:55 Sources 1

About this happening: KU Leuven DistriNet published technical findings on 85 crypto wallet browser extensions that leak enough data to link addresses and track users across sites, creating iden...

Open Happening

Rokarolla Android banking trojan activity

Malware Activity
H score26 First: 16.06.2026 16:15 Last: 16.06.2026 16:15 Sources 1

About this happening: The Rokarolla Android banking trojan is expanding phone-level control on infected devices, letting attackers steal credentials, intercept authentication codes, and hide fr...

Open Happening

Android 17 expands platform security and privacy protections

Security Tool/Service
H score15 First: 12.05.2026 20:00 Last: 12.05.2026 20:00 Sources 1

About this happening: Android 17 will add a broad set of Google-backed security and privacy controls next month, reducing exposure to banking scam calls, device theft, and OTP theft...

Open Happening

Timeline

  1. 21.04.2026 00:52 2 articles · 2mo ago

    FakeWallet App Store wallet-stealer disclosure

    Initial Disclosure

    Kaspersky identified FakeWallet, a campaign of 26 malicious Apple App Store apps that impersonated Metamask, Coinbase, Trust Wallet, and OneKey to steal recovery or seed phrases and drain cryptocurrency assets from users in China; the apps used fake branding, typosquatting, phishing pages, and iOS provisioning profiles, and Apple removed all 26 apps after responsible disclosure.

    Show sources
    Open in new tab