Hackers Exploit Snap Store Accounts to Distribute Cryptocurrency Theft Malware on Linux

Cryptocurrency hackers are manipulating trusted Linux software for stealing digital assets. They employ a new strategy that transforms legitimate Snap Store packages into malicious software.

Key Takeaways:

Hackers are taking advantage of reputable Snap Store packages to steal cryptocurrencies by hijacking existing publisher accounts.
These attacks exploit expired domains and email addresses to push harmful updates.
The incidents expose vulnerabilities in the platform’s trust and security framework.

According to Alan Pope, an Ubuntu contributor and former Canonical developer, rather than creating new accounts on the Snap Store operated by Canonical, attackers have started overtaking existing publisher accounts.

This method exploits expired web domains and email addresses tied to long-established Snap Store developers. The attackers register these domains and then use the regained access to hijack Snapcraft accounts.

Turning Legitimate Packages into Malware

Once the attackers gain access, they can push malicious updates to previously harmless packages, catching users off-guard with automatic installations and established trust signals.

The Snap Store, like many significant package repositories, has historically been a target for malware campaigns.

Initially, the attempts were relatively basic, with scammers publishing fake cryptocurrency wallet applications through newly created accounts.

As these early efforts became easier to detect, hackers began using deceptive tactics, creating malicious applications that employed similar characters from other alphabets to bypass filters.

As Pope notes, the method changed to a bait-and-switch strategy. Attackers would upload innocent software under generic names like “lemon-throw” or “alpha-hub,” often pretending to offer simple games. After receiving approval and exhibiting inactivity for a time, they would quietly roll out an update that introduced a fraudulent crypto wallet designed to steal users' funds.

The latest threat is more severe. In at least two verified instances, attackers acquired dissolved domains that were once owned by genuine Snap publishers and utilized them to spread wallet-stealing malware through automatic updates.

Although these applications seemed legitimate, they were engineered to capture wallet recovery phrases and send them to servers controlled by the attackers.

Unfortunately, by the time users recognized unusual activity, their funds and sensitive information had already been compromised.

Canonical has subsequently removed the malicious snaps, but Pope cautioned that this response emphasizes deeper flaws in the platform’s trust model.

He highlighted that domain takeovers weaken the long-term reliability of publishers as a safety measure and advocated for enhanced protections, such as tracking domain expirations, enforcing more robust account verification for inactive publishers, and implementing mandatory two-factor authentication.

Security Researcher Raises Concern About Snap Store Delays

Additionally, Pope pointed out that there have been delays in taking down reported malicious snaps, which can extend across several days.

He recommended that users use extra caution when installing cryptocurrency wallets on Linux, urging them to download directly from official project websites rather than app stores.

To aid users in assessing risks, Pope developed SnapScope, a web-based tool that flags suspicious or malicious snaps before installation.

He also encouraged developers to keep their domain registrations active and secure their Snapcraft and email accounts using two-factor authentication.

According to Chainalysis, illicit cryptocurrency addresses received a staggering $154 billion in 2025, marking a significant leap from the previous year.

In a related incident, U.S. prosecutors charged 23-year-old Brooklyn resident Ronald Spektor with stealing approximately $16 million in cryptocurrency from around 100 Coinbase users through an alleged phishing and social engineering scheme.