Android Malware SEEDSNATCHER Targets Users for Data Exfiltration and Command Execution

A sophisticated new Android malware, dubbed SeedSnatcher, is actively targeting cryptocurrency users globally, aiming to steal sensitive digital wallet recovery phrases and execute malicious commands. Distributed deceptively via Telegram under the guise of a cryptocurrency-related application, this threat poses a significant risk to the security of digital assets.

The malware, identified under the package name com.pureabuladon.auxes, operates with alarming precision. Researchers have detailed a coordinated campaign where promotional teams track installations using unique agent identifiers, suggesting a structured and operationally mature criminal enterprise. This allows for efficient management and exploitation of infected devices, escalating the threat to a widespread level.

SeedSnatcher’s primary modus operandi involves a multi-layered approach to bypass security measures and gain deep access to a user’s device. Initially, it requests minimal permissions, such as SMS access, making its presence less conspicuous. However, once installed, the malware systematically escalates its privilege level, gradually gaining access to increasingly sensitive information and functionalities, an approach designed to reduce user suspicion.

The technical execution of SeedSnatcher demonstrates considerable expertise in Android exploitation. It employs advanced techniques such as dynamic class loading and stealthy WebView content injection. Additionally, its command-and-control (C2) instructions are encoded as integers rather than descriptive operation names, a tactic that significantly hinders detection by security systems.

According to security analysts at Cyfirma, the malware maintains continuous WebSocket communication with its command server, located at apivbe685jf829jf[.]a2decxd8syw7k[.]top. This real-time, two-way communication capability allows the operators to issue remote commands and tasks to infected devices efficiently.

Evidence suggests that the threat actors behind SeedSnatcher are China-based or Chinese-speaking individuals. This is supported by user interface elements observed in demonstrations, which are presented entirely in Chinese. The presence of numerous compromised devices within their control panel indicates an active and operational ecosystem, rather than a nascent or experimental project.

This level of sophistication and organization points to a well-resourced group with substantial experience in conducting large-scale financial cyberattacks. The clear financial motivation driving this operation is further evidenced by the campaign’s distributed nature, which includes commission structures designed to funnel profits back to team leaders, indicative of a professional criminal enterprise focused on maximizing returns through systematic cryptocurrency theft.

Wallet Interface Spoofing and Seed Phrase Harvesting

SeedSnatcher’s most dangerous capability lies in its ability to create convincing fake cryptocurrency wallet interfaces. These deceptive interfaces trick users into revealing their critical seed phrases, also known as recovery phrases. The malware employs a sophisticated mapping system that directs users to spoofed screens mirroring their preferred wallet applications.

This targeted approach includes support for popular wallets such as Trust Wallet, TokenPocket, imToken, MetaMask, Coinbase Wallet, TronLink, TronGlobal, Binance Chain Wallet, and OKX Wallet. When a user attempts to open one of these legitimate applications, SeedSnatcher’s overlay permissions allow it to display a counterfeit import screen that is virtually indistinguishable from the genuine interface. This stealthy overlay technique is a key component of the malware’s phishing strategy.

The technical implementation of this spoofing mechanism shows meticulous attention to detail. For instance, when targeting Trust Wallet, the malware hardcodes the legitimate package name, com.wallet.crypto.trustapp, and utilizes matching UI elements to maximize deception. The malware intercepts user input through its own interface components while maintaining the visual appearance of the genuine application.

What significantly enhances the effectiveness of this attack is the enforcement of BIP39 dictionary validation. This feature ensures that only properly formatted mnemonic phrases are captured, preventing errors that could alert the victim or render the stolen phrase useless. By loading the complete BIP39 wordlist from the application’s assets, the malware validates each word entry in real-time.

This validation mechanism dramatically increases the success rate of wallet takeovers by guaranteeing that the attackers receive usable seed phrases with zero failed import attempts. Once captured, these mnemonics are immediately exfiltrated to the attacker’s infrastructure, granting them complete access to the victim’s cryptocurrency holdings and enabling unauthorized fund transfers. Victims are left with no recourse for recovery.

The orchestrated nature of the SeedSnatcher operation, combined with its proven ability to harvest active cryptocurrency wallets, firmly positions it as one of the most dangerous mobile malware threats currently targeting digital asset users.