CP
cyberpings
Malware & RansomwareHIGH

AppsFlyer SDK Hijacked to Deploy Crypto-Stealing Malware

BCBleepingComputer·Reporting by Bill Toulas
Summary by CyberPings Editorial·AI-assisted·Reviewed by Rohit Rana
Updated:
🎯

Basically, hackers used a popular tool to steal cryptocurrency by changing wallet addresses on websites.

Quick Summary

What Happened This week, the AppsFlyer Web SDK was hijacked in a serious supply-chain attack. Malicious code was injected into the SDK, which is widely used for marketing analytics by over 15,000 businesses globally. The compromised code was designed to intercept cryptocurrency wallet addresses entered by users on various websites. Instead of sending funds to the intended wallet, the

What Happened

This week, the AppsFlyer Web SDK was hijacked in a serious supply-chain attack. Malicious code was injected into the SDK, which is widely used for marketing analytics by over 15,000 businesses globally. The compromised code was designed to intercept cryptocurrency wallet addresses entered by users on various websites. Instead of sending funds to the intended wallet, the malicious code redirected them to the attackers' wallets.

The attack was discovered by Profero researchers, who found obfuscated JavaScript being delivered through the official AppsFlyer domain. This incident highlights the vulnerabilities that can arise when third-party SDKs are compromised, affecting countless downstream applications and their users. The attack window is believed to have occurred between March 9 and March 11, 2026.

Who's Affected

The impact of this attack is significant, considering the 100,000 mobile and web applications that utilize the AppsFlyer SDK. Users of these applications, especially those involved in cryptocurrency transactions, are at risk. The compromised SDK targeted major cryptocurrencies, including Bitcoin, Ethereum, Solana, Ripple, and TRON. This broad targeting means that a large number of users could potentially have their funds diverted.

AppsFlyer itself has stated that it detected and contained the incident on March 10. However, the full scope of the attack remains uncertain. While they confirmed that no customer data was accessed on their systems, the potential for financial loss among users is a serious concern.

What Data Was Exposed

The malicious JavaScript code was crafted to maintain normal SDK functionality while secretly monitoring for cryptocurrency wallet input. When a user entered their wallet address, the code would replace it with the attacker's address, exfiltrating the original address along with any associated metadata. This means that any cryptocurrency transactions made during the attack could have been compromised.

The incident raises alarms about the security of third-party SDKs, which are often trusted components in many applications. The fact that this attack could occur through a widely used SDK underscores the need for vigilance in monitoring third-party dependencies.

What You Should Do

Organizations using the AppsFlyer SDK should take immediate action. It's crucial to review telemetry logs for any suspicious API requests originating from websdk.appsflyer.com. Downgrading to known-good versions of the SDK may also be necessary. Additionally, companies should investigate any potential compromises and communicate with their users about the risks involved.

AppsFlyer is currently working with external forensic experts to understand the full impact of the incident and has promised to provide updates as the investigation progresses. Users should remain cautious and monitor their cryptocurrency transactions closely during this time.

🔒 Pro insight: Analysis pending for this article.

Original article from

BCBleepingComputer· Bill Toulas
Read Full Article

Also covered by

SCSC Media

AppsFlyer SDK hijacked in supply-chain attack targeting cryptocurrency

Read Article

Share

Related Pings

HIGHMalware & Ransomware

Malware Newsletter Round 91 - Latest Threats and Insights

The latest malware newsletter reveals new threats like Infiniti Stealer and npm supply chain attacks. Developers and organizations must stay alert to evolving risks in cybersecurity.

Security Affairs·
HIGHMalware & Ransomware

Malicious Email Delivers CMD Malware - Privilege Escalation Alert

A malicious email has delivered a .cmd malware file that escalates privileges and bypasses antivirus systems. Users are at risk of significant system compromise. Awareness and immediate action are vital to mitigate this threat.

Security Affairs·
HIGHMalware & Ransomware

Axios NPM Package Compromised - Supply Chain Attack Exposed

A major supply chain attack compromised the Axios NPM package, affecting millions of users. Malicious versions deployed a RAT, posing serious security risks. Swift action was taken to remove the threats.

Trend Micro Research·
HIGHMalware & Ransomware

Brokk Hacked - Play Ransomware Exposes Sensitive Data

Brokk has reportedly been hacked by Play ransomware, leading to the leak of sensitive corporate data. This incident could severely impact the company's reputation and security. Organizations must bolster their defenses to prevent similar breaches.

SC Media·
HIGHMalware & Ransomware

Chaos Malware - New Targeting of 64-bit Linux Servers

Chaos malware has evolved to target 64-bit Linux servers, expanding its attack surface. This shift raises alarms for organizations relying on these systems. Enhanced security measures are now crucial to protect against potential larger-scale attacks.

SC Media·
HIGHMalware & Ransomware

Phorpiex Botnet - Spreading Ransomware and Sextortion Tactics

The notorious Phorpiex botnet is back, spreading ransomware and sextortion schemes. Millions are at risk as it targets users globally. Stay alert and protect your devices from this evolving threat.

Cyber Security News·