Crypto Phishing Applications On The Play Store

Cyble Research identified an active campaign distributing 20+ malicious Android apps on Google Play that impersonate cryptocurrency wallets (PancakeSwap, SushiSwap, Raydium, etc.) to phish users' 12-word mnemonic phrases via WebView-loaded phishing pages and apps built with the Median framework; the operation uses shared infrastructure (50+ phishing domains on common IPs) and likely compromised developer accounts, and includes detailed IOCs (hashes, URLs, domains) with many apps removed from the Play Store but some remaining live.