Linux users beware: Snap Store experiences hacker attacks, impersonating wallets to steal seed phrases

【BlockBeats】Recently, security research organizations disclosed that a new type of attack has been discovered in the Snap application store on the Linux platform. Attackers take over expired developer domains to successfully hijack long-standing publisher accounts and then deploy malicious applications. This method breaks through the traditional trust mechanisms of app stores and poses a serious threat to cryptocurrency wallet users.

Detailed Explanation of the Attack Method

The core strategy of the hackers is to monitor developer accounts in the Snap store associated with expired domains. Once a target domain is found to be invalid, the attacker immediately registers it, then uses the email associated with that domain to trigger a password reset for the account in the Snap Store, easily taking over the publisher identity that has long been established. The consequences of this are extremely serious—legitimate software installed by users years ago could be compromised overnight through official update channels, with malicious code embedded, often without the user’s awareness.

According to disclosed data, the publisher domains storewise.tech and vagueentertainment.com have been confirmed to be affected by such hijacking.

Deception Tactics and Fund Theft Process

The malicious applications that are tampered with usually disguise themselves as mainstream crypto wallets such as Exodus, Ledger Live, or Trust Wallet. Their interfaces are nearly indistinguishable from the genuine software, enough to confuse most users. After launching, the app first connects to remote servers for network verification, then, under various pretexts (such as “import existing wallet” or “verify account”), it诱导 users to input “wallet recovery seed phrases.” Once users submit these sensitive private key-related details, the data is immediately transmitted to the attacker’s server, and the victim’s funds are instantly transferred.

Because this type of attack cleverly exploits existing trust relationships, victims often suffer losses before they even realize something is wrong. For Linux users holding crypto assets, it is essential to stay vigilant, regularly check the sources of installed applications, and avoid installing wallet apps from third-party sources as current preventive measures.