Fake MetaMask app steals cryptocurrency

This report details a phishing campaign that hosts fake MetaMask pages and distributes modified mobile apps (Android APK and iOS installer) which prompt victims to enter wallet seed phrases; the apps validate phrases against an embedded dictionary and exfiltrate valid seeds to an attacker-controlled C2 (http://39.109.123.213/handler.ashx). The analysis includes APK metadata and JavaScript evidence, many phishing domains and hostnames, and a large set of IoCs (file hashes and URLs) to aid detection and response, with recommendations for user and bank precautions.