Fake Airdrop App Slips Into Solana dApp Store to Steal Seed Phrases

A malicious app named SKR Claim landed in the official Solana dApp Store, and its entire pitch was a trap for wallet recovery phrases. Solana Mobile says an intruder gained unauthorized access to the dApp Publishing Portal, then used it to push updates to the App Spotlight and Quests interface. The app's ask was blunt: hand over your seed phrase.

The lure was a classic one. SKR Claim dressed itself up to look like familiar brands in the decentralized ecosystem, then told victims to sync their primary wallet under the guise of checking eligibility for a free airdrop. Investigators found the interface wouldn't let users move forward until they had typed out the complete 12- or 24-word mnemonic.

The scary part is what it didn't do. Lab tests showed the app never touched a blockchain — no real transaction processing, no local validation of the entered data, nothing routed to decentralized nodes. Network traffic logs tell the real story: the phrases were packaged up and shipped through encrypted requests to an external command-and-control server.

So how did it get past store review? Analysts point to deferred payload delivery — submitting a clean, basic build that satisfies initial security policies, then flipping on the hostile features later through remote updates. According to researchers, the app racked up thousands of downloads before community reports finally triggered a formal detection.

Infrastructure clues point to a hastily assembled operation. Security specialists found the receiving server's domain was secured with SSL certificates issued just days before the campaign went live, and registration records were anonymous in a deliberate attempt to hide where the operators were based. The attackers cast a wide net, going after both self-custody browser extension wallets and mobile storage setups.

Cybersecurity firms flagged the case to the app store's administrators. Official documentation confirms the malicious package identifier was removed from the public catalog once its hostile behavior was verified.