A set of 26 malicious apps on Apple App Store impersonate popular wallets, such as Metamask, Coinbase, Trust Wallet, and OneKey, to steal recovery or seed phrases and drain them of cryptocurrency assets.

The threat actor used multiple methods to imitate official products, including typosquatting and fake branding, to lure users in China into downloading them.

Because such apps are restricted in the country, the attacker published them as games or calculator apps, likely in the hope of being perceived by the users as a trick to bypass the bans in the country.

Kaspersky researchers say that all 26 fake apps are part of the same campaign, which they named FakeWallet, and associate them with the SparkKitty operation that…