“SeedSnatcher” Android Malware Targets Crypto Users, Using Overlay Phishing and BIP 39 Validation to Steal Seed Phrases

SeedSnatcher is an Android malware campaign that targets cryptocurrency users by masquerading as a wallet app called Coin and employing overlay phishing and BIP 39 validation to steal seed phrases. Distributed mainly through Telegram and social channels, it lures victims into installing a fake application and uses a WebView to load a legitimate-looking interface from m.weibo[.]com to conceal its malicious activity.

According to Cyfirma, the malware features device profiling, data exfiltration, command execution, and targeted phishing of cryptocurrency wallets, with the aim of financial theft. It can launch fake overlay screens that mimic wallets such as MetaMask, Trust Wallet and Coinbase, and, when a user recovers their wallet on these screens, it captures the seed phrase, loading the full BIP 39 wordlist from the app’s assets to validate each mnemonic word entered.

The campaign also intercepts SMS, harvests contacts and call logs, and supports remote commands via integer-based codes, while evidence points to a coordinated, multi-affiliate distribution model led by a China-based group.