SeedSnatcher represents a significant threat to cryptocurrency users worldwide. Packaged under the seemingly innocent name “Coin” and distributed through Telegram, this Android malware has emerged as a sophisticated tool designed specifically to steal digital wallet recovery codes and execute remote commands on infected devices.

The malware, registered under the package name com.pureabuladon.auxes, operates as a coordinated campaign with alarming capabilities that extend far beyond simple data theft.

The attack unfolds through a deceptive distribution model where promotional teams use unique agent identifiers to track installations and manage victims.

What makes SeedSnatcher particularly dangerous is its multi-layered approach to evading security measures.

The malware initially requests minimal permissions like SMS access, but once installed, it systematically escalates its privilege level to gain access to sensitive information.

Malicious builds (Source - Cyfirma) — Malicious builds (Source – Cyfirma)

This gradual permission escalation reduces suspicion while establishing a persistent foothold on the victim’s device.

Account Access Permissions (Source - Cyfirma) — Account Access Permissions (Source – Cyfirma)

The malware’s technical architecture reveals deep expertise in Android exploitation. It leverages dynamic class loading, stealthy WebView content injection, and command-and-control instructions encoded as integers rather than descriptive operation names. This numeric obfuscation significantly hinders security detection systems.

Cyfirma security analysts identified that the malware maintains constant WebSocket communication with its command server at apivbe685jf829jf[.]a2decxd8syw7k[.]top, enabling real-time two-way communication for remote tasking.

The operators behind SeedSnatcher appear to be China-based or Chinese-speaking threat actors, evidenced by the user interface presented entirely in Chinese during demonstrations.

The presence of numerous already-compromised devices in their control panel suggests an active, operational ecosystem rather than an experimental project.

This level of sophistication indicates an organization with substantial resources and experience in conducting large-scale financial attacks.

The financial motivation driving this operation is unmistakable. The distributed nature of the campaign, complete with commission structures that route money back to team leaders, reveals a professional criminal enterprise designed for maximizing profits through systematic cryptocurrency theft.

Wallet Interface Spoofing and Seed Phrase Harvesting

SeedSnatcher’s most dangerous capability lies in its ability to create convincing fake cryptocurrency wallet interfaces that trick users into revealing their critical seed phrases.

The malware includes a mapping system that directs users to spoofed screens matching their preferred wallets, including Trust Wallet, TokenPocket, imToken, MetaMask, Coinbase Wallet, TronLink, TronGlobal, Binance Chain Wallet, and OKX Wallet.

When a user opens one of these legitimate applications, the malware’s overlay permission allows it to display a counterfeit import screen that appears virtually identical to the real wallet interface.

The technical implementation demonstrates remarkable attention to detail. For Trust Wallet specifically, the malware hardcodes the legitimate package name com.wallet.crypto.trustapp and uses matching UI elements to maximize deception.

Developer demonstration (Source - Cyfirma) — Developer demonstration (Source – Cyfirma)

The code structure shows how the malware intercepts user input through its own interface components while maintaining the visual appearance of the genuine application.

What makes this attack particularly effective is the enforcement of BIP39 dictionary validation, which ensures that only properly formatted mnemonic phrases are captured.

SMS Data exfiltration (Source - Cyfirma) — SMS Data exfiltration (Source – Cyfirma)

By loading the complete BIP39 wordlist from the application’s assets, the malware validates each word entry in real-time, preventing typing mistakes and guaranteeing that only valid, immediately usable seed phrases reach the attacker’s server.

Attack Chain (Source - Cyfirma) — Attack Chain (Source – Cyfirma)

This validation mechanism dramatically increases the success rate of wallet takeovers, as attackers receive ready-to-import recovery codes with zero failed import attempts.

Once captured, these mnemonics are immediately exfiltrated to the attacker’s infrastructure, granting complete access to the victim’s cryptocurrency holdings and enabling unauthorized fund transfers that leave no recovery option for the victim.

The orchestrated nature of this operation, combined with its proven ability to harvest active cryptocurrency wallets, positions SeedSnatcher as one of the most dangerous mobile malware threats targeting digital asset users today.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post SEEDSNATCHER Android Malware Attacking Users to Exfiltrate Sensitive Data and Execute Malicious Commands appeared first on Cyber Security News.