- SHA1: 3c4b49440be91b4e7262b6d3732cc93972daab45
Description
A trojan for iOS-based mobile devices. It is built into one of the MetaMask wallet versions modified by the malicious actors. It steals mnemonic seed phrases used to access crypto wallets and sends them to the attackers’ server. To distribute the trojan, malware creators use specially created malicious websites that copy the appearance of MetaMask project’s genuine site. The malware is installed using configuration and provisioning profiles that allow downloading and installing apps outside the App Store.
A comparison between the genuine website (left) and fake one (right):
Operating routine
The IPhoneOS.CoinSteal.2 is a full-fledged version of the MetaMask application with implanted malicious functionality. It looks and operates just like the original safe version. The data theft goes unnoticed by the users.
Upon launch, the trojan displays the app’s main menu. There, the user can either create new crypto wallets or import already existing ones.
In both cases, the user has to enter their seed phrase for authorization into the corresponding field. At that, the seed phrase is covertly sent to the C&C server located at hxxps://admin[.]metamaskio[.]vip/api/posstkey.
