FakeWallet iOS Crypto Stealer Campaign Delivered Through 26 Apple App Store Apps (SparkKitty-linked, Chinese-speaking Actor) — Threadlinqs Intelligence
As of 2026-05-30, FakeWallet iOS Crypto Stealer Campaign Delivered Through 26 Apple App Store Apps (SparkKitty-linked, Chinese-speaking Actor) is a critical-severity malware threat attributed to FakeWallet operators (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 56 indicators of compromise.
Threat ID: TL-2026-0395 · Severity: CRITICAL · Status: MONITORING · Category: MALWARE
Attribution: FakeWallet operators · China · FINANCIAL
Kaspersky Securelist disclosed 26 phishing iOS applications distributed through the official Apple App Store — most concentrated in the Chinese storefront — impersonating MetaMask, Ledger, Trust
On 20 April 2026, Kaspersky Securelist (Sergey Puzan, GReAT) published a technical deep-dive revealing that throughout March 2026 the Apple App Store — particularly the Chinese storefront — was flooded with phishing applications masquerading as well-known cryptocurrency wallets. Kaspersky identified 26 such apps spanning MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie. Because Apple's regional policies block the legitimate wallet apps for users whose Apple ID is set to the China region, the FakeWallet operators weaponised typosquatting (mimicked icons, intentionally misspelled names) and deceptive promotional banners that claimed the 'official wallet is unavailable in the App Store' to drive installs. Several of the apps have since been pulled following Kaspersky's disclosure to Apple, but additional dormant apps without yet-activated phishing logic remain in the ecosystem and are positioned for a switch-flip via future update.
Each App Store app itself is only a stub — a calculator, task planner, or small game — whose real purpose is to open a browser link on launch. That link pivots the victim through a malicious enterprise provisioning-profile install of a trojanised wallet build. Enterprise provisioning profiles were designed for corporate in-house app distribution, but have long been abused by cracked-app, casino, cheat, and malware operators — and are the same profile type that SparkKitty leveraged. The installed payload then behaves in one of three technical patterns depending on the target wallet.
Pattern 1 — Hot wallet injection via dylib + Objective-C swizzling: The attackers add extra load commands to the main Mach-O executable so the dyld linker pulls in a malicious library (e.g. libokexHook.dylib in the Coinbase clone). Initialisation routines — either Objective-C +[UIViewController load] and +[UIView load] methods, or C++ static initialisers in __mod_init_functions — swap the original viewDidLoad of the recovery-phrase screen (e.g. RecoveryPhraseViewController) with a hijacked version. The hooked viewDidLoad walks the current view controller's subview tree, extracts mnemonic words as they are entered, concatenates them, encrypts the resulting string with RSA using PKCS #1 padding, Base64-encodes the ciphertext, and POSTs it together with a module type, app name, and a hardcoded unique code to a C2 URL of the form /api/open/postByTokenPocket?ciyu=<b64>&code=10001&ciyuType=1&wallet=<name>.
Pattern 2 — Trust Wallet __hook trampoline: Instead of initialisation hooks, the attackers append a custom __hook section to the main executable, placed just before __text in the region normally reserved for load commands. The first two entries are trampolines resolving dlsym and the original WalletCore mnemonic-validation routine; the next pair are wrappers that resolve the symbols dataInit or processX0Parameter from the malicious library, hand control to them, and then execute the original replaced method. This rewires every code path where the app validates, imports, or generates a seed phrase, leaking the mnemonic to the C2 before the legitimate logic runs.
Pattern 3 — Ledger cold-wallet phishing via malicious library or React Native tamper: Because Ledger Live is a UI front for a hardware wallet and cannot silently read recovery phrases, the attackers use in-app phishing. In the library variant, an entry function loads a config file containing C2 URL (e.g. hxxps://iosfc[.]com/ledger/ios/Rsakeycatch.php), a numeric 'code' such as 10001, and a login-url plus login-code. +[UIViewController load] and +[UIView load] overrides traverse the view hierarchy; when a screen named add-account-cta or one containing a $ sign is rendered, the malware identifies the locale from the 'add account' button text, constructs a localised 'security check' phishing notification, and stores it in GlobalVariables. When the victim subsequently opens an account-add or buy/sell screen, the notification surfaces and opens a
Weaknesses (CWE)
CWE-506, CWE-829, CWE-601, CWE-922, CWE-494
Target sectors: cryptocurrency, financial, consumer, web3, individual-investors, high-net-worth-individuals
Target regions: China, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 56 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.002, T1189, T1566.002, T1204.001, T1204.002, T1575, T1554, T1546, T1574.006