Introduction
Cybercriminals are constantly evolving their tactics to steal cryptocurrency, and a recent campaign uncovered in March 2026 proves that even the Apple App Store is not immune. Security researchers detected more than twenty phishing apps masquerading as popular crypto wallets like MetaMask, Ledger, Trust Wallet, and Coinbase. Once installed, these apps redirect users to browser pages that look identical to the App Store, where they trick victims into downloading trojanized versions of legitimate wallets. These infected apps are specifically designed to hijack recovery phrases and private keys, giving attackers full control over your crypto assets. This how-to guide will walk you through the steps to protect yourself from such threats, based on the tactics observed in the FakeWallet campaign.
What You Need
- An iOS device (iPhone or iPad) with the latest iOS version installed.
- A reliable internet connection.
- Access to the official Apple App Store (not third-party stores).
- Knowledge of the official website or support pages for the cryptocurrency wallet you intend to use.
- (Optional) A reputable mobile security app that detects malware like Kaspersky (which detects this threat as HEUR:Trojan-PSW.IphoneOS.FakeWallet.*).
Step-by-Step Guide
Step 1: Understand How the Attack Works
Before you can defend against it, you need to recognize the scam. In this campaign, attackers exploit the fact that some official crypto wallet apps are unavailable in certain regions due to App Store restrictions (for example, when an Apple ID is set to the Chinese region). Scammers create fake apps that appear high in search results using typosquatting (intentional misspellings like “Ledger Wallet” instead of “Ledger Live”) and icons that mimic the originals. Once you open the app, it shows a stub – a functional placeholder like a calculator or game – to appear legitimate. But hidden functionality redirects you to a phishing webpage that looks like the App Store and prompts you to download a trojanized version of the real wallet. This fake wallet then steals your recovery phrase or private key when you use it.
Step 2: Verify the App’s Authenticity Before Downloading
Always check the developer name, download count, reviews, and official website links. For example, the real MetaMask app is developed by “MetaMask” (with that exact spelling). Compare the app icon against the official one from the wallet’s website. Be wary of apps with names that have extra spaces, missing letters, or unusual characters. If the app claims that the official wallet is “unavailable in the App Store” and asks you to download it via the app itself, that is a huge red flag. In the FakeWallet campaign, promotional banners within the fake app made such claims.
Step 3: Only Download Wallets from Official Sources
Navigate to the official website of the wallet (e.g., metamask.io for MetaMask) and follow the link to the App Store from there. Do not search for wallet apps on the App Store using generic terms like “crypto wallet” – scammers pay for top rankings. If you must search, double-check the developer name and app ID. Note that as of this campaign, researchers identified 26 phishing apps mimicking MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie. Also watch out for apps that have no crypto-related name or icon but feature promotional material claiming to be a wallet – these are likely stubs waiting to activate malicious features in future updates.
Step 4: Be Cautious of Redirection Prompts
The FakeWallet apps redirect users to browser pages designed to look like the App Store. If any app asks you to leave the app and download something from a web page that imitates the App Store, close it immediately. Real apps never force you to download from an external site. Instead, legitimate updates are handled through the App Store’s own update mechanism.
Step 5: Inspect the App’s Permissions and Behavior
After installation, look for unusual permissions requests. A calculator app should not need internet access or the ability to read from the pasteboard (which could capture your copied recovery phrase). If the app suddenly opens Safari or other browsers without your explicit action, uninstall it. The stub behavior observed in this campaign included games, calculators, and task planners – so if a generic utility app starts asking for crypto-related data, treat it as malicious.
Step 6: Use Security Software for Additional Protection
Install a reputable mobile security app that can detect malware. For example, Kaspersky detects these threats as HEUR:Trojan-PSW.IphoneOS.FakeWallet.* and HEUR:Trojan.IphoneOS.FakeWallet.*. Such tools can scan your device and alert you if a known phishing app is present. Keep the security software updated to catch new variants.
Step 7: Report Suspicious Apps to Apple
If you encounter a suspicious app, report it to Apple using the “Report a Problem” link on the App Store product page. In March 2026, after researchers reported 26 phishing apps, Apple removed several of them. Your report can help protect others. Also, share your findings with security communities to raise awareness.
Step 8: Secure Your Recovery Phrases and Private Keys
Never enter your recovery phrase or private key into any app that you have not verified as genuine. Use hardware wallets for cold storage when possible. If you suspect you have entered your phrase into a fake app, immediately transfer your funds to a new wallet with a newly generated phrase. Do not reuse the compromised wallet.
Tips for Ongoing Protection
- Keep iOS updated: Apple releases security patches regularly. Install them promptly to close vulnerabilities that scammers might exploit.
- Enable two-factor authentication (2FA) on your Apple ID and any crypto exchange accounts.
- Be skeptical of typosquatted names: Even a single letter difference can mean a fake app.
- Cross-check with official social media accounts of the wallet provider for any announcements about App Store availability.
- Remember the timeline: This campaign began in fall 2025 and escalated by March 2026, with new malicious modules and injection techniques. Vigilance is a continuous effort.
- Use a dedicated device for cryptocurrency transactions if possible, and avoid installing unknown apps on it.
- Educate yourself about the specific wallets targeted: MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, Bitpie – and check them individually after any major news.
By following these steps and staying informed about evolving threats like the FakeWallet campaign, you can significantly reduce the risk of losing your cryptocurrency to mobile phishing attacks.