Linux users should be aware of a new type of attack on the Snap Store, where hackers can take over developers' identities to trick users into submitting their seed phrase.

**On January 21st, SlowMist CISO 23pds alerted Linux users to a new Snap Store attack targeting cryptocurrency assets.** Attackers are hijacking domains to deploy backdoors for stealing users’ encrypted funds. Tampered apps masquerade as well-known crypto wallets—including Exodus, Ledger Live, and Trust Wallet—with interfaces nearly identical to legitimate versions, tricking users into entering their wallet recovery seed phrases. Here’s how the exploit works: Attackers monitor Snap Store developer accounts for expired associated domains. Once they find an expired domain, they register it immediately, then use the domain’s linked email to reset the Snap Store publisher’s password, taking over the identity of a long-trusted developer. 23pds emphasized this means software users trusted for years could be compromised overnight via official updates. Two publisher domains—storewise[.]tech and vagueentertainment[.]com—have already been hijacked using this method. When launched, the tampered apps first connect to a remote server for “network verification,” then lure users into submitting their recovery seed phrases. Sensitive data is sent to attackers’ servers instantly, resulting in stolen funds. Because the attack exploits existing trust in official publishers, victims often don’t realize they’ve been targeted until after funds are gone.