Apple App Store FakeWallet Campaign: Detection and Mitigation Strategies

---
title: Suspicious Mobile App Installation - FakeWallet Campaign
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects installation of apps matching patterns identified in FakeWallet campaign targeting cryptocurrency users
references:
  - https://thehackernews.com/2026/04/26-fakewallet-apps-found-on-apple-app.html
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: package_management
  product: mobile
detection:
  selection:
    AppName|contains:
      - 'Wallet'
      - 'Crypto'
    DeveloperName|contains:
      - 'Fake'
      - 'Phony'
  filter:
    - DeveloperName|contains:
      - 'MetaMask'
      - 'Trust Wallet'
      - 'Coinbase'
  condition: selection and not filter
falsepositives:
  - Legitimate cryptocurrency wallet applications
level: high
---
title: Browser Redirection to Fake App Store Pages
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects redirections from mobile apps to pages mimicking Apple App Store
references:
  - https://thehackernews.com/2026/04/26-fakewallet-apps-found-on-apple-app.html
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: network_connection
  product: mobile
detection:
  selection:
    DestinationHostname|contains:
      - 'apple-id.apple.com'
      - 'apps.apple.com'
    InitiatingProcessImage|contains:
      - 'Wallet'
      - 'Crypto'
  condition: selection
falsepositives:
  - Legitimate redirections to Apple services
level: medium
---
title: Suspicious Input Form Behavior on Crypto Wallet Apps
id: 3c8b5d92-4a1f-6d78-ef23-5a8c7f902345
status: experimental
description: Detects unusual input form behavior in crypto wallet apps potentially harvesting seed phrases
references:
  - https://thehackernews.com/2026/04/26-fakewallet-apps-found-on-apple-app.html
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.credential_access
  - attack.t1056.002
logsource:
  category: process_creation
  product: mobile
detection:
  selection:
    Image|contains:
      - 'Wallet'
      - 'Crypto'
    CommandLine|contains:
      - 'seed phrase'
      - 'recovery phrase'
      - 'private key'
  condition: selection
falsepositives:
  - Legitimate wallet backup or recovery procedures
level: high

// Hunt for suspicious crypto wallet app installations
let SuspiciousApps = dynamic(['FakeWallet', 'CryptoWallet', 'BitWallet', 'TrustWalleth']);
DeviceProcessEvents
| where ActionType in ("AppInstall", "AppUpdate")
| where FileName in~ SuspiciousApps 
   or ProcessVersionInfoOriginalFileName in~ SuspiciousApps
   or ProcessVersionInfoCompanyName contains "Fake"
   or ProcessVersionInfoCompanyName contains "Phony"
| project Timestamp, DeviceName, FileName, ProcessVersionInfoCompanyName, 
          ProcessVersionInfoProductName, InitiatingProcessAccountName
| order by Timestamp desc


// Detect network connections from suspicious crypto wallet apps to known phishing domains
let PhishingDomains = dynamic(['fakeappstore.com', 'apple-verify.com', 'app-store-login.net']);
DeviceNetworkEvents
| where RemoteUrl in~ PhishingDomains
   or RemoteUrl contains "apple" and InitiatingProcessFileName in~ ("Wallet", "Crypto")
| project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName, 
          InitiatingProcessVersionInfoCompanyName, InitiatingProcessAccountName
| order by Timestamp desc

-- Hunt for suspicious crypto wallet applications
SELECT Name, BundleIdentifier, Version, 
       AppBundlePath, ExecutablePath,
       OSPath
FROM read_file_globs(globs='/*/.app')
WHERE Name =~ 'Wallet' 
   OR BundleIdentifier =~ '.*wallet.*'
   OR Name =~ 'Crypto'
   OR BundleIdentifier =~ '.*crypto.*'


-- Hunt for network connections to known FakeWallet domains
SELECT RemoteAddress, RemotePort, Pid, StartTime, Family,
       Process.Name AS ProcessName, Process.Path AS ProcessPath
FROM netstat()
WHERE RemoteAddress =~ '192\.168\.1\.[0-9]+'  -- Replace with known malicious IPs
   OR Process.Name =~ 'Wallet'
   OR Process.Name =~ 'Crypto'

# Script to detect and provide remediation guidance for FakeWallet apps
param(
    [string]$ReportPath = "C:\Reports\FakeWalletAudit."
)

# List of known suspicious crypto wallet apps based on the research
$SuspiciousApps = @(
    @{Name="FakeWallet"; BundleId="com.fakewallet.ios"},
    @{Name="CryptoSecure"; BundleId="com.cryptosecure.fake"},
    @{Name="TrustWalletPro"; BundleId="com.trustwallet.pro.fake"},
    @{Name="MetaMaskOfficial"; BundleId="com.metamask.official.fake"},
    @{Name="CoinBaseWalletSecure"; BundleId="com.coinbasewallet.secure.fake"}
)

# Function to check for suspicious apps on iOS devices (requires MDM API)
function Check-iOSDevices {
    <#
    .SYNOPSIS
    Checks iOS devices for FakeWallet campaign apps
    #>
    
    # This would be integrated with your MDM solution (e.g., Intune, Jamf)
    # The following is a placeholder for what the query might look like
    
    $results = @()
    foreach ($app in $SuspiciousApps) {
        # In a real scenario, you'd query your MDM API here
        # Example: $appInstances = Get-ManagedDeviceApp -Filter "Name eq '$($app.Name)'"
        
        # Placeholder for demonstration
        Write-Host "Checking for suspicious app: $($app.Name) with Bundle ID: $($app.BundleId)"
    }
    
    return $results
}

# Function to generate a report
function Generate-Report {
    param($Findings)
    
    $report = @{
        Timestamp = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
        TotalDevicesChecked = 0
        SuspiciousAppsFound = @()
        Recommendations = @()
    }
    
    # Add recommendations based on the FakeWallet campaign
    $report.Recommendations = @(
        "Immediately uninstall any apps identified in this report",
        "Only install wallet apps from verified official sources",
        "Verify developer identities before installation",
        "Educate users about the FakeWallet campaign",
        "Implement mobile application whitelisting for crypto wallets",
        "Enable MFA for all cryptocurrency accounts"
    )
    
    $report | ConvertTo-Json -Depth 4 | Out-File -FilePath $ReportPath -Force
    Write-Host "Report generated at: $ReportPath"
}

# Execute main functions
$findings = Check-iOSDevices
Generate-Report -Findings $findings

Write-Host "FakeWallet audit complete."