# SeaFlower backdoors iOS, Android crypto wallets for seed theft

Published: 2022-06-13 · Severity: routine · Sectors: technology, financial-services
Canonical: https://vorant.io/reports/0de326e9-594f-5cdb-878e-6535f160827d/seaflower-backdoors-ios-android-crypto-wallets-for-seed-theft

> Chinese-speaking attackers modify popular web3 wallets with backdoors exfiltrating seed phrases via trojanized app distribution.

SeaFlower is a sophisticated campaign targeting web3 users by distributing backdoored versions of legitimate cryptocurrency wallet applications—MetaMask, Coinbase Wallet, TokenPocket, and imToken across iOS and Android. The attackers modify wallet binaries to inject malicious dylib files and hooking frameworks (Logos, MonkeyDev, Cydia Substrate) that transparently exfiltrate seed phrases without altering normal wallet functionality. Victims download backdoored apps from cloned websites impersonating legitimate wallet download pages, often discovered through SEO poisoning on Chinese search engines like Baidu and Sogou.

The technical approach uses React Native bundle injection on iOS, hooking the dataWithContentsOfFile function to intercept seed-phrase storage and transmit it via HTTPS to attacker-controlled domains mimicking legitimate infrastructure (e.g., trx.lnfura[.]org spoofing infura.io). Android variants use similar hooking techniques. The campaign infrastructure, including provisioning profiles and signing certificates, is hosted in Chinese and Hong Kong IP space, with domains using .cn TLDs. Leaked macOS usernames ("lanyu", "trader", "Zhang Haike") and Chinese-language source code comments indicate Chinese-speaking threat actors. This represents a complete supply-chain style compromise of mobile wallet applications targeting a broad base of web3 users, particularly those using Chinese search engines.

## Mentioned in this report

- Threat actors: SeaFlower
- Malware: SeaFlower, libmetaDylib.dylib
- Campaigns: SeaFlower

## Detection guidance (public sample)

### macOS Mach-O Dylib Injection Tool Execution

ATT&CK: T1195.001

Detects execution of known Mach-O dylib injection and repackaging tools (insert_dylib, optool, yololib) on macOS, the technique used to backdoor legitimate wallet app binaries as in SeaFlower. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Mach-O Dylib Injection Tool Execution
description: Detects execution of dylib injection tools (insert_dylib, optool, yololib)
  or MonkeyDev usage on macOS, as used to repackage legitimate apps with malicious
  hooking dylibs (SeaFlower-style backdoored wallets). Most relevant on build hosts
  or developer endpoints.
tags:
- attack.initial-access
- attack.t1195.001
- attack.stealth
- attack.t1036
logsource:
  category: process_creation
  product: macos
detection:
  selection_tool:
    Image|endswith:
    - /insert_dylib
    - /optool
    - /yololib
  selection_cmd:
    CommandLine|contains:
    - MonkeyDev
    - CydiaSubstrate
  condition: 1 of selection_*
falsepositives:
- Legitimate iOS security researchers or jailbreak tweak developers repackaging apps
  for testing
- Developers using MonkeyDev or Cydia Substrate for tweak development
level: medium
id: aca40a3d-d6c2-5cab-a1d3-88ebad45d93f
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x6F.html
```

### Web Proxy Access to Homoglyph Lookalike of Infura Domain

ATT&CK: T1583.001

Detects web requests to hosts using the 'lnfura' homoglyph spoof of infura.io, as used by SeaFlower to exfiltrate seed phrases over HTTPS to lookalike infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Proxy Access to Homoglyph Lookalike of Infura Domain
description: Detects proxy traffic to hostnames containing the homoglyph 'lnfura'
  (lowercase L in place of i) that impersonate the infura.io blockchain API, used
  for wallet seed-phrase exfiltration.
tags:
- attack.resource-development
- attack.t1583.001
- attack.exfiltration
- attack.t1041
logsource:
  category: proxy
detection:
  selection:
    cs-host|contains: lnfura
  condition: selection
falsepositives:
- Security teams testing or sinkholing the typosquatted domain
- Threat intelligence crawlers accessing the lookalike domain
level: high
id: da91b1c4-cfb8-59e8-85df-fbb9c4bd7b1e
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x6F.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://objective-see.org/blog/blog_0x6F.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0de326e9-594f-5cdb-878e-6535f160827d/seaflower-backdoors-ios-android-crypto-wallets-for-seed-theft.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup