SEEDSNATCHER Android Malware Attacking Users to Exfiltrate Sensitive Data and Execute Malicious Commands

SeedSnatcher is an active, sophisticated Android malware campaign that targets cryptocurrency users by spoofing wallet import interfaces and validating BIP39 seed phrases to harvest ready-to-use recovery mnemonics; it uses overlay attacks, dynamic class loading, WebView injection, and WebSocket C2 (apivbe685jf829jf.a2decxd8syw7k.top), and is distributed via Telegram with agent-based tracking and commission-based operations.