{
 "slug": "kaspersky-fakewallet-26-ios-apps-apr-2026",
 "title": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
 "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026",
 "json": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "multi-evm",
  "bitcoin",
  "tron"
 ],
 "method": "fake-app",
 "product": "iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps",
 "tags": [
  "multi-evm",
  "bitcoin",
  "tron",
  "fake-app",
  "ios",
  "app-store",
  "kaspersky",
  "sparkkitty",
  "metamask",
  "ledger",
  "trust-wallet",
  "coinbase",
  "seed-phrase",
  "developer-profile"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-04-20",
 "closedAt": "2026-04-20",
 "updatedAt": "2026-04-20T12:00:00Z",
 "summary": "Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.",
 "timeline": [
  {
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "Kaspersky finds 26 fake crypto wallet apps on Apple's App Store that can drain digital assets",
   "url": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "publisher": "Kaspersky",
   "date": "2026-04-20"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if an App Store game, calculator or to-do app sent you to a page offering a crypto wallet download, or asked you to install a developer profile, and you then created or restored a wallet in that app.\n\n## What to do now\nCreate a new wallet with a new recovery phrase in the official app and move all funds there. Remove the fake wallet and any developer profile you did not get from your employer (Settings > General > VPN & Device Management). Delete the decoy app.\n\n## How to avoid this\nInstall wallets only through links on the wallet maker's official website. Never install a configuration or developer profile to get an app. Only enter a hardware-wallet recovery phrase on the device itself; Ledger's app never asks for it.",
 "notes": null,
 "agentBrief": "# Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases\n\n- Severity: High · Status: Partly contained (past)\n- Chains: Multiple EVM chains, Bitcoin, Tron · Method: Fake wallet and trading apps\n- Started: Apr 20, 2026 · Last update: Apr 20, 2026\n- Who/what: iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps\n\nKaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.\n\n## Am I affected?\nYou may be affected if an App Store game, calculator or to-do app sent you to a page offering a crypto wallet download, or asked you to install a developer profile, and you then created or restored a wallet in that app.\n\n## What to do now\nCreate a new wallet with a new recovery phrase in the official app and move all funds there. Remove the fake wallet and any developer profile you did not get from your employer (Settings > General > VPN & Device Management). Delete the decoy app.\n\n## How to avoid this\nInstall wallets only through links on the wallet maker's official website. Never install a configuration or developer profile to get an app. Only enter a hardware-wallet recovery phrase on the device itself; Ledger's app never asks for it.\n\n## Sources\n- Kaspersky finds 26 fake crypto wallet apps on Apple's App Store that can drain digital assets (Kaspersky, 2026-04-20): https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets\n\nFull record: https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026 · JSON: https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}