BombFlower Backdoor: Uncovering an Evasive Fake Wallet Campaign

CertiK reports on the BombFlower campaign, an organized criminal group deploying trojanized Android wallet apps that conceal and install an embedded malicious APK which hooks wallet mnemonic generation to exfiltrate users' private keys. The group employs advanced evasion (embedded ZipBomb anti-forensics), SEO manipulation, and distributed cloud hosting to avoid detection and maximize victim reach; network captures and timeline analysis demonstrate active exploitation and infrastructure commonalities across samples.