Hackers Exploit Snap Packages to Steal Cryptocurrency

Linux users are facing a growing cybersecurity threat as hackers infiltrate Snap packages in Snapcraft, the central app store for Ubuntu and other Linux distributions. Security experts warn that cybercriminals are now targeting dormant apps, especially cryptocurrency wallets, to trick users into revealing sensitive information. These attacks have already led to losses totaling hundreds of thousands of dollars, raising urgent concerns for Linux enthusiasts and crypto holders alike.

How Hackers Are Targeting Snapcraft

Snapcraft, maintained by Canonical, is a trusted platform for distributing Linux apps. Snaps are self-contained software packages that include all dependencies, are compressed, and cryptographically signed to ensure security. Traditionally, Linux users have relied on Snap Store for safe downloads. However, cybercriminals are finding new ways to bypass security measures and compromise trusted accounts.

Instead of creating fake apps from scratch, hackers are now targeting Snap packages whose publishers’ domain registrations have expired. By registering these expired domains, attackers can trigger password resets on Snap Store accounts, gaining control of legitimate apps with established trust histories. Once in control, they inject malware disguised as popular cryptocurrency wallets.

Real Losses From Malicious Snaps

Recent incidents illustrate the severity of this threat. One user reportedly lost $490,000 in bitcoin after downloading a malicious version of the Exodus Wallet app. Another Linux user who installed a fake “Ledger Live” snap lost $10,000. These attacks highlight how effective the scammers’ tactics have become, combining social engineering with strategic account takeovers.

Dozens of suspicious cryptocurrency wallets were flagged last year by Alan Pope, Director of Developer Relations at Anchore and a former Canonical employee. Pope emphasizes that while some malicious snaps are caught by automated filters, many slip through unnoticed, putting Linux users at serious risk.

New Tactics Worry Security Experts

According to Pope, cybercriminals are evolving their methods to remain undetected. “There’s a relentless campaign by scammers to publish malware in the Canonical Snap Store. Some get caught by automated filters, but plenty slip through,” he explains. The attackers’ main goal appears to be compromising cryptocurrency wallet users, particularly those using apps like Exodus, Ledger Live, and Trust Wallet.

The malware often asks victims to enter their wallet recovery phrases, sending these credentials directly to the attackers. Once obtained, hackers can drain wallets and move the stolen funds almost instantly. This technique allows even small, inexperienced cybercriminals to exploit unsuspecting Linux users.

Why Linux Users Are at Risk

Many Linux users assume that open-source platforms are inherently safer than other operating systems. While Linux does benefit from strong security frameworks, the rise of targeted attacks on trusted app stores like Snapcraft shows that no platform is immune. The combination of trusted apps, domain expiration vulnerabilities, and clever social engineering creates an ideal environment for cybercriminals.

Protecting Yourself From Snap Malware

To stay safe, Linux users should regularly verify the authenticity of Snap packages and ensure apps are downloaded from legitimate publishers. Avoid entering sensitive information into unfamiliar prompts, and monitor domain registrations related to your frequently used apps. Keeping backups of wallet recovery phrases offline can also reduce the impact of potential malware attacks.

Alan Pope’s insights highlight a broader lesson for the Linux community: vigilance is crucial. With attackers constantly developing new tactics, even experienced users need to remain cautious when downloading apps from online repositories.

The Growing Need for Snap Security Awareness

The Snap Store remains a valuable resource for Linux software distribution, but the increasing number of targeted attacks should serve as a wake-up call. Developers and users alike must prioritize security awareness, monitor account activity, and implement strong safeguards to prevent unauthorized access. As cryptocurrency adoption grows, these malware attacks on Linux users are likely to continue unless proactive measures are taken.