Developers of the cryptocurrency wallet Leather have reported that a counterfeit version of their wallet has been discovered in the Apple App Store. Victims of the fake app claim that it stole their digital assets.
Last week, Leather developers alerted the community to the presence of a fake version of their wallet in the Apple App Store. It was clarified that the company does not currently offer an iOS app, and the genuine Leather can only be downloaded from the official website (leather.io).
Leather representatives advised people who entered their secret passphrase in the fake app to immediately transfer their cryptocurrency to a new wallet. The passphrase was likely passed on to the attackers, who could then steal all the funds.
Although Apple was notified of the forgery more than a week ago, the fake app from the developer LetalComRu remained available in the App Store for almost two weeks. According to social media posts, users continued to lose money due to the fake app as recently as yesterday. Only today did Apple remove the counterfeit from the store and revoke the developer’s access to the Apple Developer Program.
As Bleeping Computer notes, the bogus app had a rating of 4.9 out of 5.0, although most reviews appeared to be fake, using random and similar names, with virtually identical text.
Since the App Store does not provide data on the number of downloads, it is unknown how many people managed to download the cryptocurrency-stealing fake app.
It is worth noting that this is not the first such case, despite all of Apple’s security measures. For example, in February 2024, a fake version of the LastPass password manager was discovered in the App Store. Apparently, the app was phishing and intended to steal user credentials.
However, in the case of Leather, the authors of the fake app did not try to mimic the original but took advantage of the company’s lack of a real iOS app.