Trust Hijacked: Hackers Seize Expired Domains to Poison Linux Snap Apps

A new attack trend targets the Linux Snap ecosystem by hijacking expired domains belonging to legitimate snap publishers, allowing attackers to take over accounts and push malicious updates to thousands of users. The approach leverages trust in publishers, with the Snap Store hosting over 7,000 applications, meaning a compromised update can affect a large user base who previously trusted the original author.

According to Alan Pope, the campaign is a “relentless” campaign that exploits domain lapse to seize control and undermine a key trust signal: publisher longevity. The report notes that the primary aim appears to be financial theft, with cryptocurrency wallets singled out as a major danger zone.

Pope advises users to be extremely cautious with cryptocurrency wallet applications from any source and to consider obtaining them directly from official project websites, while urging Canonical to tighten safeguards such as monitoring for domain expiry and enabling two‑factor authentication for dormant accounts. For now, the defence rests on vigilance, including keeping domain registrations current and enabling two‑factor authentication for snap publishers. January 22, 2026.