AppsFlyer Web SDK Supply Chain Hijack via Domain Registrar Compromise for Cryptocurrency Theft — Threadlinqs Intelligence
As of 2026-05-30, AppsFlyer Web SDK Supply Chain Hijack via Domain Registrar Compromise for Cryptocurrency Theft is a high-severity supply chain threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0229 · Severity: HIGH · Status: RESOLVED · Category: SUPPLY_CHAIN
Attribution: N/A · FINANCIAL
The AppsFlyer Web SDK (websdk.appsflyer.com) was hijacked through a domain registrar compromise on March 9-10, 2026. A professional-grade 7-module JavaScript interception framework replaced
On March 9, 2026, security firm Profero discovered that the AppsFlyer Web SDK, served from websdk.appsflyer.com, was delivering a malicious JavaScript payload to all websites loading the SDK. AppsFlyer confirmed a domain registrar incident that gave attackers control over the appsflyer.com domain, enabling them to serve malicious code from the legitimate SDK endpoint.
The malicious payload was a ~170 KB minified JavaScript file — far larger and more sophisticated than a typical crypto clipper. Analysis revealed a professional-grade interception framework with seven distinct modules: ActuateElements (DOM mutation surveillance), ConsoleGuard (console output suppression for anti-forensics), Destinations (attacker wallet management), KillElements (anti-forensics element removal), NetHooksmith (network request/response interception), XorCipherBytes (XOR encryption for C2 communications), and Accounting/AccountingForTransfer (portfolio tracking and transfer monitoring).
The payload employed multi-layered obfuscation using base91 string encoding with 17 distinct shuffled alphabets. Dead code injection — including LRU caches, linked-list helpers, anagram checkers, and SHA-256 implementations — further obscured analysis. Runtime-only string resolution defeated static analysis tools. Function names (oFmFNH, iVp0dU7, byZJpo, fLOUxWf) and class names (wPwwVol, QA903T, IE62Yb) were randomized.
The operational attack chain worked as follows: (1) The payload replaced globalThis.fetch with a proxy function (wlpPd2t) and patched XMLHttpRequest.prototype.open/send/setRequestHeader via SLkiCz() to intercept all network traffic. (2) Five regex-based interceptors — one per cryptocurrency format (Bitcoin, Ethereum, Solana, Ripple, TRON) — scanned fetch/XHR response bodies for wallet addresses. (3) MutationObserver-based DOM watchers (classes wPwwVol, QA903T) monitored input fields in real-time and swapped wallet values on change events. (4) Matched addresses were replaced with attacker-controlled wallets fetched at runtime from the C2 server via function p58Xob(). (5) Original addresses, page URLs, and timestamps were exfiltrated via XOR-encrypted POST requests to the C2 server.
A suspicious endpoint websdk.appsflyer.com/v1/api/plugin was observed during the compromise window and is not present in AppsFlyer's normal documentation — this was likely the C2 endpoint used for wallet address distribution and data exfiltration. Because the C2 provided runtime configuration, the framework was capable of arbitrary data interception per C2 instruction — the crypto-clipping behavior was just the observed mode of operation.
AppsFlyer's official exposure window was March 9, 20:40 UTC to March 10, 10:30 UTC (approximately 14 hours). Profero researchers estimated a broader window from March 9, 22:45 UTC through March 11. AppsFlyer confirmed the mobile SDK was not affected and stated their investigation found no evidence of customer data on AppsFlyer systems being accessed. The company resolved the domain registrar issue and notified customers directly. The domain was fully restored by March 12, 2026.
Given that AppsFlyer's SDK platform serves 15,000 businesses across 100,000+ mobile and web applications — spanning e-commerce, fintech, healthcare, and SaaS sectors — the blast radius of this supply chain compromise was exceptionally large. Any website loading the SDK during the exposure window served the malicious payload to its visitors. The attack demonstrates how third-party marketing analytics SDKs, widely trusted and deeply embedded in web applications, represent high-value supply chain targets.
Weaknesses (CWE)
CWE-829, CWE-506, CWE-494, CWE-350
Target sectors: technology, e-commerce, financial, healthcare, saas, marketing, advertising, mobile-applications
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1584, T1195, T1059, T1204, T1027, T1027, T1140, T1070, T1185, T1115