Beware of Domain Resurrection Attacks: Hackers Use Snap Mechanism to Inject Malicious Code and Impersonate Well-Known Wallets

[CryptoWorld] Security organizations have recently exposed a targeted scam activity against Linux platform users. The hackers’ approach is as follows: they purchase developer domains after they expire and then directly update the original legitimate applications through official channels. Unaware users trust these applications, which have already been embedded with malicious code.

This attack is particularly cunning—the hackers disguise the applications as well-known wallets like Exodus, Ledger Live, and Trust Wallet, tricking users into entering their seed phrases to steal their crypto assets. It has been confirmed that the domains storewise.tech and vagueentertainment.com have been hijacked.

The most frightening part is that this type of attack completely exploits the trust mechanism of the Snap system itself. Originally trusted software is covertly altered without the user’s knowledge, making it difficult to detect. This “domain resurrection attack” is an invisible security trap for users who rely on open-source software and official app stores. If you are using Linux systems and related wallet applications, be sure to watch out for abnormal updates from official channels, and verify the developer information and update logs when necessary.