Kaspersky
3 incidents, 0 live. 185 days since the last new one.
3 drains in the last 12 months
3 drains in the last 12 months
2 drains in 2026
1 drains in 2025
Past
April 2026 1
-
High◐Partly contained
Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases
Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.
iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps·Multiple EVM chains, Bitcoin, Tron·Since Apr 20, 2026·
February 2026 1
-
Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down
Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published.
People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)·Multiple EVM chains·Since Feb 24, 2026·
October 2025 1
-
Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks
Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given.
Web3 and crypto executives, founders and blockchain developers·Multiple EVM chains·Since Oct 28, 2025·
No drains match these filters.