- SHA1: 8573f66774ba5bda6eb2e427c691c03d62737a80
Description
A trojan for iOS-based mobile devices. It is built into one of the TokenPocket crypto wallet versions modified by the malicious actors. It steals mnemonic seed phrases used to access crypto wallets and sends them to the attackers’ server. To distribute the trojan, malware creators use specially created malicious websites that copy the appearance of the TokenPocket project’s genuine site. The malware is installed using configuration and provisioning profiles that allow downloading and installing apps outside the App Store..
A comparison between the genuine website (left) and fake one (right):
Operating routine
The IPhoneOS.CoinSteal.6 is a full-fledged version of the TokenPocket application with implanted malicious functionality. It looks and operates just like the original safe version. The data theft goes unnoticed by the users.
Upon launch, the trojan displays the app’s main menu. There, the user can either create new crypto wallets or import already existing ones.
In both cases, the user has to enter their seed phrase for authorization into the corresponding field. At that, the seed phrase is covertly sent to the C&C server located at hxxp://admin[.]tokenpocket[.]pm/api/key.
