Fake WalletConnect app scams steal $70K from Google Play Users in its five month campaign

A crypto wallet drainer that was posing as WalletConnect has stolen more than $70,000 from unsuspecting users on the Google Play Store. Despite Google's security standards, this rogue application was able to avoid detection for over five whole months, reminding us that even legitimate app stores can hold deceptive and hazardous threats.

The application first appeared under the name of Mestox Calculator in March, before changing its identity several times to avoid being detected. Through the persona of an innocuous calculator application, the malicious app managed to pass through Google Play's security checks. However, once installed, it redirected users to a backend that drained crypto wallets.

Downloaded more than 10,000 times before being removed from Google store

The fraudulent WalletConnect software gained awareness through fake reviews, which artificially increased its position in the Google Play Store. This creative strategy made the software appear more reputable, resulting in a higher number of downloads.

During the time when the application was active in the Google Play Store, the application was downloaded more than 10,000 times before being removed. But not everyone who downloaded the application was attacked, only those who connected a wallet or met the malware's specific targeting criteria were affected.

Once installed, users were driven to a fraudulent website that asked them to link their crypto wallets. The program then misled users into allowing numerous transactions, resulting in the theft of their money. This strategy is part of a larger trend of phising assaults against the crypto ecosystem, which has become more sophisticated in recent years.

A reminder to strengthen security in the Digital Asset World

This is the first time a drainer app has exclusively targeted mobile users, which is very concerning for crypto holders. It also acts as a wake-up call to the digital asset community regarding the ever evolving landscape of cyber threats in Decentralized finance, as well as the increasing sophistication of cybercriminals exploiting weakness in the crypto ecosystem.

This incident also highlights the growing threat of mobile-targeted scams in the cryptocurrency space. Experts stress the importance of user awareness as the strongest defence against crypto-related scams. Users have to ensure the validity of any software, especially when dealing with sensitive financial information.

Users should refrain from downloading wallet software from unverified sites or platforms and should always verify the authenticity of any app or service before connecting their wallets.In addition, security experts are advocating for AI-driven solutions to detect and prevent sophisticated threats, arguing that app store protections alone are no longer adequate.

This incident highlights the ongoing risk that, despite Google Play’s efforts to block malicious code, fraudsters can still infiltrate official platforms, especially when their tactics involve redirection rather than direct infection.