A technically sophisticated threat actor known as SeaFlower has been targeting Android and iOS users as part of an extensive campaign that mimics official cryptocurrency wallet websites intending to distribute backdoored apps that drain victims’ funds.
Said to be first discovered in March 2022, the cluster of activity “hint[s] to a strong relationship with a Chinese-speaking entity yet to be uncovered,” based on the macOS usernames, source code comments in the backdoor code, and its abuse of Alibaba’s Content Delivery Network (CDN).
“As of today, the main current objective of SeaFlower is to modify Web3 wallets with backdoor code that ultimately exfiltrates the seed phrase,” Confiant’s Taha Karim said in a technical deep-dive of the campaign.
Targeted apps include Android and iOS versions of Coinbase Wallet, MetaMask, TokenPocket, and imToken.
images from Hacker News