The danger of Snap attacks in Linux: a new threat to cryptocurrency wallets

According to reports from PANews, security experts have identified a new threat in the Linux Snap Store ecosystem. It involves an organized campaign where cybercriminals gain control over expired domains owned by developers and use them to distribute compromised versions of legitimate software. This threat poses a serious risk to cryptocurrency wallet users.

How attackers seize domains and modify applications

The attack scheme is built as follows: cybercriminals monitor developer domain names that have become inactive and re-register them under their control. Then, through official Snap Store channels, they embed malicious code into applications that users believe are safe and trusted. Two compromised domains have been identified as examples: storewise.tech and vagueentertainment.com, which were used to distribute infected software.

Target wallets and phishing method

Criminals disguise their malicious applications as popular cryptocurrency wallets — Exodus, Ledger Live, and Trust Wallet. The goal of the attack is to intercept users’ private data. When the victim launches a fake application, they see an interface identical to the original wallet and enter their mnemonic phrases (seed phrases), believing they are restoring access to their wallet. In reality, this data is captured by the attackers, who gain full control over the user’s cryptocurrency assets.

The danger of the Snap mechanism and the spread of threats in Linux systems

The peculiarity of this attack is that Snap applications have historically been considered a reliable way to distribute software in Linux due to built-in security mechanisms. However, criminals are exploiting this channel by injecting malicious code into applications that were initially legitimate. Linux users are unaware of the malware installation because the application is downloaded from an official repository and appears to have passed security checks. This vulnerability makes zapret linux an especially relevant topic for the Linux developer and user community.

It is recommended to carefully verify the sources of downloaded applications, ensure the authenticity of the developer before entering sensitive data, and use additional verification tools when working with wallets.