SeaFlower backdoors iOS, Android crypto wallets for seed theft
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Chinese-speaking attackers modify popular web3 wallets with backdoors exfiltrating seed phrases via trojanized app distribution.
SeaFlower is a sophisticated campaign targeting web3 users by distributing backdoored versions of legitimate cryptocurrency wallet applications—MetaMask, Coinbase Wallet, TokenPocket, and imToken across iOS and Android. The attackers modify wallet binaries to inject malicious dylib files and hooking frameworks (Logos, MonkeyDev, Cydia Substrate) that transparently exfiltrate seed phrases without altering normal wallet functionality. Victims download backdoored apps from cloned websites impersonating legitimate wallet download pages, often discovered through SEO poisoning on Chinese search engines like Baidu and Sogou.
The technical approach uses React Native bundle injection on iOS, hooking the dataWithContentsOfFile function to intercept seed-phrase storage and transmit it via HTTPS to attacker-controlled domains mimicking legitimate infrastructure (e.g., trx.lnfura[.]org spoofing infura.io). Android variants use similar hooking techniques. The campaign infrastructure, including provisioning profiles and signing certificates, is hosted in Chinese and Hong Kong IP space, with domains using .cn TLDs. Leaked macOS usernames ("lanyu", "trader", "Zhang Haike") and Chinese-language source code comments indicate Chinese-speaking threat actors. This represents a complete supply-chain style compromise of mobile wallet applications targeting a broad base of web3 users, particularly those using Chinese search engines.
Mentioned in this report
Detection guidance
macOS Mach-O Dylib Injection Tool Execution
Detects execution of known Mach-O dylib injection and repackaging tools (insert_dylib, optool, yololib) on macOS, the technique used to backdoor legitimate wallet app binaries as in SeaFlower. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Mach-O Dylib Injection Tool Execution
description: Detects execution of dylib injection tools (insert_dylib, optool, yololib)
or MonkeyDev usage on macOS, as used to repackage legitimate apps with malicious
hooking dylibs (SeaFlower-style backdoored wallets). Most relevant on build hosts
or developer endpoints.
tags:
- attack.initial-access
- attack.t1195.001
- attack.stealth
- attack.t1036
logsource:
category: process_creation
product: macos
detection:
selection_tool:
Image|endswith:
- /insert_dylib
- /optool
- /yololib
selection_cmd:
CommandLine|contains:
- MonkeyDev
- CydiaSubstrate
condition: 1 of selection_*
falsepositives:
- Legitimate iOS security researchers or jailbreak tweak developers repackaging apps
for testing
- Developers using MonkeyDev or Cydia Substrate for tweak development
level: medium
id: aca40a3d-d6c2-5cab-a1d3-88ebad45d93f
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x6F.html
Web Proxy Access to Homoglyph Lookalike of Infura Domain
Detects web requests to hosts using the 'lnfura' homoglyph spoof of infura.io, as used by SeaFlower to exfiltrate seed phrases over HTTPS to lookalike infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Proxy Access to Homoglyph Lookalike of Infura Domain
description: Detects proxy traffic to hostnames containing the homoglyph 'lnfura'
(lowercase L in place of i) that impersonate the infura.io blockchain API, used
for wallet seed-phrase exfiltration.
tags:
- attack.resource-development
- attack.t1583.001
- attack.exfiltration
- attack.t1041
logsource:
category: proxy
detection:
selection:
cs-host|contains: lnfura
condition: selection
falsepositives:
- Security teams testing or sinkholing the typosquatted domain
- Threat intelligence crawlers accessing the lookalike domain
level: high
id: da91b1c4-cfb8-59e8-85df-fbb9c4bd7b1e
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x6F.html
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x6F.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs