Cryptocurrency wallet maker SafePal disclosed that an authorization flaw in a third-party order-tracking plug-in exposed personal data of about 39,798 customers, and a threat actor is now selling it. The flaw worked like a parcel tracker that lets one customer see another's order simply by changing the order number, exposing names, email addresses, shipping addresses, phone numbers, and purchase details for orders placed between March 2025 and April 2026. Seed phrases, private keys, wallet passwords, and payment data were not affected. SafePal warned customers to expect phishing and impersonation, and noted that a fake firmware-update lure had already been seen. It has taken down more than 30 fraudulent sites.
Kaspersky detailed OkoBot, a Windows malware framework active since 2025 whose standout module, SeedHunter, tricks hardware-wallet owners into giving up their recovery phrase. On an infected PC, the malware waits for wallet software like Ledger Live, Ledger Wallet, or Trezor Suite, sometimes until the device is plugged in, then displays a malicious page asking for the seed phrase from inside the wallet's own genuine app. Because the surrounding application is the real one the victim installed, the request looks legitimate, but anyone who types in the phrase hands over full control of their funds. Kaspersky counted hundreds of victims across more than 25 countries, and the framework remains active.
Attackers compromised a legitimate maintainer's GitHub account for the Injective blockchain SDK and used it to push a malicious version of the widely used @injectivelabs/sdk-ts npm package, which has around 50,000 weekly downloads. The tainted code, disguised as usage telemetry, hooked the SDK's wallet key-generation functions to capture private keys and seed phrases, then sent them to a server made to look like legitimate Injective infrastructure. Trusted-publishing automation spread the malicious release across 18 packages within minutes, though it was live under an hour before being pulled. Because the theft can reach apps that used the SDK only indirectly, any wallet keys handled by affected versions should be treated as compromised.
Kaspersky identified 26 malicious iOS apps live on the Apple App Store impersonating major cryptocurrency wallets including MetaMask, Coinbase, Trust Wallet, Ledger, TokenPocket, imToken, Bitpie, and OneKey. The campaign, named FakeWallet and linked to the SparkKitty operation, has been running since fall 2025. The apps used typosquatted names, cloned icons, and stub functionality (games, calculators, task planners) to pass App Store review. Some embed compromised viewDidLoad routines that scan the screen for mnemonic words as the user types and exfiltrate seed phrases via RSA-encrypted payloads. Apple removed 25 of the 26 after disclosure; the developer behind the 26th was terminated.
A new supply-chain worm is loose on npm, stealing developer credentials and republishing itself automatically from whichever compromised account it lands on. Socket and StepSecurity identified the attack in packages published by Namastex Labs, a company that builds agentic AI tooling, with 16 package versions confirmed malicious so far and the first poisoned release (pgserve 1.1.11 on April 21 at 22:14 UTC) followed by two more the same day. The injected code grabs tokens, API keys, SSH keys, credentials for cloud services, CI/CD systems, container registries, and LLM platforms, plus Kubernetes and Docker configs, then rifles through Chrome and Firefox for cryptocurrency wallet data including MetaMask, Exodus, Atomic Wallet, and Phantom. If the malware finds an npm publish token in environment variables or ~/.npmrc, it identifies every package the victim can publish, injects itself into each, bumps the version, and republishes - a worm in the literal sense. It applies the same trick to PyPI via a .pth-based payload if Python credentials are present, making this a cross-ecosystem threat. Socket and StepSecurity note the techniques mirror TeamPCP's CanisterWorm attacks but stop short of definitive attribution.
TrustStrike Labs