Hackers Exploit Snap Domains to Inject Malicious Code into Linux Software Packages

A campaign is actively hijacking Snap Store publisher accounts by registering expired publisher domains, using password resets to take over established publisher accounts and push malicious revisions that act as cryptocurrency wallet stealers; the malware harvests recovery phrases and exfiltrates them (via Telegram bots), employing obfuscation (homoglyphs) and bait-and-switch publication techniques. The report documents C2 artefacts, sample Telegram identifiers, and recommends mitigations including domain expiry monitoring, mandatory 2FA, and stricter verification for account recovery.