SafePal Data Breach: 39,798 Customers Exposed and Data for Sale — Defensive Playbook for Phishing and Wallet-Targeting Follow-On Attacks

---
title: DNS Query to SafePal Typosquat or Phishing Domain
id: 3f8a2c14-9b1d-4e57-a6c2-7d5f8e0a1b2c
status: experimental
description: Detects DNS lookups for domains impersonating SafePal that do not match official SafePal infrastructure. Follow-on phishing campaigns from hardware wallet vendor breaches consistently rely on typosquatted domains to harvest seed phrases.
references:
  - https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1583.001
logsource:
  category: dns
  product: windows
detection:
  selection_keyword:
    query|contains:
      - 'safepal'
      - 'safe-pal'
      - 'safepa1'
      - 'safepaI'
      - 'safepalwallet'
      - 'safepal-support'
      - 'safepal-verify'
      - 'safepal-update'
  filter_official:
    query|contains:
      - 'safepal.com'
      - 'safepal.io'
  condition: selection_keyword and not filter_official
falsepositives:
  - Security researchers or brand-protection services intentionally visiting phishing infrastructure
level: high
---
title: Executable Masquerading as SafePal Application from User-Writable Path
id: 8c4d1f06-2a7b-4e93-b5d1-6f0c3a9e2d84
status: experimental
description: Detects execution of binaries branded as SafePal wallet software or firmware updaters launching from temporary, user profile, or other non-standard install paths. Breach follow-on campaigns distribute fake SafePal installers that are infostealers or clipboard hijackers.
references:
  - https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains:
      - 'safepal'
      - 'safe-pal'
    OriginalFileName|contains:
      - 'safepal'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Public\'
      - '\ProgramData\'
      - '\Windows\Temp\'
  condition: selection_name and selection_path
falsepositives:
  - Users legitimately running a downloaded SafePal installer from Downloads — validate hash against official vendor signature
level: high
---
title: PowerShell or Script Content Soliciting Cryptocurrency Seed Phrase
id: 5b7e9a31-4c2d-4f18-93a6-1e8b5d2c7f90
status: experimental
description: Detects script or command-line content referencing seed/recovery phrase entry in combination with wallet branding — a hallmark of phishing pages, malicious "verification" scripts, and fake wallet-update tooling delivered after wallet-vendor breaches.
references:
  - https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.credential_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_phrase:
    CommandLine|contains:
      - 'seed phrase'
      - 'recovery phrase'
      - 'mnemonic'
      - '12 words'
      - '24 words'
  selection_wallet:
    CommandLine|contains:
      - 'safepal'
      - 'wallet'
      - 'verify'
  condition: selection_phrase and selection_wallet
falsepositives:
  - Rare; legitimate enterprise tooling does not solicit seed phrases via command line
level: critical

// Hunt 1: Outbound connections to SafePal typosquat / impersonation domains
// Excludes official SafePal domains; tune the allowlist to confirmed vendor infrastructure.
let OfficialDomains = dynamic(["safepal.com", "safepal.io"]);
union withsource=SourceTable
(DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any ("safepal", "safe-pal", "safepa1", "safepalwallet", "safepal-verify", "safepal-update")
    | extend RemoteHost = tostring(parse_url(RemoteUrl).Host)
    | where not(RemoteHost has_any (OfficialDomains))
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, SourceTable),
(CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where DestinationHostName has_any ("safepal", "safe-pal", "safepa1", "safepalwallet", "safepal-verify", "safepal-update")
    | where not(DestinationHostName has_any (OfficialDomains))
    | project TimeGenerated, SourceIP, DestinationHostName, DestinationIP, DeviceAction, SourceTable)
| order by TimeGenerated desc;

// Hunt 2: Inbound email leveraging SafePal branding with breach/verification lures
// Targets the expected spear-phishing wave referencing the data breach, order details, or seed phrase verification.
EmailEvents
| where TimeGenerated > ago(14d)
| where EmailDirection == "Inbound"
| where Subject has_any ("safepal", "safe pal")
   or SenderDisplayName has_any ("safepal", "safe pal")
| extend LureIndicator = iif(
    Subject has_any ("breach", "verify", "update", "security", "compromised", "recover", "urgent", "action required", "firmware"),
    "High-Suspicion Lure", "Brand Mention Only")
| project TimeGenerated, SenderFromAddress, SenderMailFromAddress, RecipientEmailAddress, Subject, LureIndicator, DeliveryAction, ThreatTypes
| order by TimeGenerated desc;

-- Hunt for fake SafePal executables and running masquerading processes
-- Targets follow-on malware (infostealers / clipboard hijackers) posing as SafePal apps or firmware updaters

-- Part 1: Running processes with SafePal branding
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)safepal' OR Exe =~ '(?i)safepal')
  AND Exe =~ '(?i)(Temp|Downloads|Roaming|Public|ProgramData)'

-- Part 2: On-disk artifacts in user-writable paths (run as separate artifact or combine)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/Downloads/*safepal*',
  'C:/Users/*/AppData/Local/Temp/*safepal*',
  'C:/Users/*/AppData/Roaming/*safepal*',
  'C:/ProgramData/*safepal*'
])
WHERE FullPath !~ '(?i)safepal\\.(com|io)'

# SafePal Breach Follow-On Threat - Endpoint Verification & Hardening Script
# Run elevated. Validates no fake SafePal binaries are present, checks DNS cache
# for typosquat resolution, and confirms SmartScreen/phishing protection state.

$report = @()

# --- 1. Scan user-writable paths for SafePal-branded executables ---
$scanPaths = @("$env:TEMP", "C:\Users\*\Downloads", "C:\Users\*\AppData\Roaming", "C:\ProgramData", "C:\Windows\Temp")
foreach ($p in $scanPaths) {
    $hits = Get-ChildItem -Path $p -Recurse -Include "*safepal*","*safe-pal*" -ErrorAction SilentlyContinue |
            Where-Object { $_.Extension -in ".exe",".msi",".bat",".ps1",".js",".vbs",".scr" }
    foreach ($h in $hits) {
        $sig = Get-AuthenticodeSignature $h.FullName
        $report += [PSCustomObject]@{
            Type = "SuspiciousBinary"; Path = $h.FullName
            Signed = $sig.Status; Signer = $sig.SignerCertificate.Subject
            Created = $h.CreationTime
        }
    }
}

# --- 2. Check DNS client cache for SafePal typosquat resolution ---
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue |
       Where-Object { $_.Entry -match "safepal|safe-pal|safepa1" -and $_.Entry -notmatch "(^|\.)safepal\.(com|io)$" }
foreach ($d in $dns) {
    $report += [PSCustomObject]@{ Type = "TyposquatDNS"; Path = $d.Entry; Signed = ""; Signer = $d.Data; Created = "" }
}

# --- 3. Verify phishing protection controls are enabled ---
$smartScreen = Get-MpPreference -ErrorAction SilentlyContinue
$report += [PSCustomObject]@{
    Type = "ControlCheck"
    Path = "Defender SmartScreen / Network Protection"
    Signed = "PUAProtection=$($smartScreen.PUAProtection); NetProtection=$($smartScreen.EnableNetworkProtection)"
    Signer = ""; Created = ""
}
# Enable network protection (blocks connections to known phishing/malware domains) if not already on
if ($smartScreen.EnableNetworkProtection -ne 1) {
    Set-MpPreference -EnableNetworkProtection Enabled
    $report += [PSCustomObject]@{ Type = "Remediation"; Path = "Enabled Defender Network Protection"; Signed=""; Signer=""; Created=(Get-Date) }
}

$report | Format-Table -AutoSize
if ($report | Where-Object { $_.Type -in "SuspiciousBinary","TyposquatDNS" }) {
    Write-Warning "Potential SafePal impersonation artifacts found - isolate host and begin IR triage."
} else {
    Write-Host "No impersonation artifacts detected." -ForegroundColor Green
}