Kaspersky, Google Reports Expose iPhone Wallet Threats of 2026

Apple, Kaspersky, Google, Microsoft and hardware vendor Trezor collectively documented a year of mobile crypto threats in 2026, with 26 fraudulent wallet applications, a five-chain iOS exploit package containing 23 individual exploits, and a confirmed in-the-wild CoreGraphics attack reported by Apple itself. Together, the reports shift the practical burden of self-custody from app-level precautions to full-device and process-level hygiene.

Apple's September 28, 2026 security notice for iOS 26.7.1 is the anchor event. The patch closed a CoreGraphics flaw allowing arbitrary code execution when a device processed a malicious file, and Apple stated it was aware the issue may have been exploited against specific targeted individuals before iOS 27. The company did not attribute the abuse to a crypto campaign or wallet theft. The operational consequence, however, is direct: a compromised phone exposes wallet applications, email and two-factor authentication codes simultaneously, collapsing the separation practitioners often assume exists between custody and communications.

How the fake wallet campaign worked

Kaspersky's FakeWallet technical report and its April 2026 SparkCat analysis describe a single broader campaign from two angles rather than unrelated outbreaks. The FakeWallet side identified 26 fraudulent App Store applications impersonating MetaMask, Ledger, Trust Wallet, Coinbase and other established brands. Icons and names copied legitimate products; some listings initially presented unrelated functionality such as calculators or games before pivoting. The campaign concentrated in the Chinese App Store, where several official wallets were unavailable, which gave the counterfeit listings a distribution gap to fill.

The counterfeit listings redirected users to imitation App Store pages and prompted installation of developer profiles. Those profiles allowed trojanized wallet apps to install outside the normal store review process. Once running, the malware intercepted wallet recovery and creation screens to capture seed phrases — full private-key control, not merely transaction interference.

The SparkCat variant pursued the same objective through a different channel. Hidden in legitimate-looking apps, its iOS component scanned photo galleries for English-language mnemonic phrases. Kaspersky found two infected apps in Apple's App Store and one in Google Play; both stores later removed the malicious code.

What does this change for practitioners?

The answer runs through recovery-phrase handling. Photographing, screenshotting or storing seed words in cloud galleries, Notes, message attachments or image folders is now a documented attack surface, not a theoretical one. Google's March 2026 Coruna investigation found five iOS exploit chains carrying 23 exploits whose financial payload decoded QR codes in images and searched Apple Memos for BIP39 word sequences and strings such as "backup phrase," alongside data from numerous wallet applications. Google stated Coruna did not function against the latest iOS version and advised updating, or enabling Lockdown Mode where an update was impossible.

Google's March 18 DarkSword report documented a separate iOS chain using six vulnerabilities against devices running iOS 18.4 through 18.7. Its malware collected wallet data, messages, contacts, photos, files and browsing history, with campaigns identified against users in Saudi Arabia, Turkey, Malaysia and Ukraine. Google said the vulnerabilities were patched by iOS 26.3, most earlier. The report's quiet implication: one compromised device exposes every wallet on it, not one.

Hardware wallets and the old-iPhone question

OneKey founder Yishi Wang cautioned in a November 1 report against treating older iPhones as cold storage, citing hardware-level vulnerabilities affecting older models. The report noted that exploitation requires physical access and specialized equipment, so the flaws do not automatically expose every stored seed. Still, airplane mode does not convert a phone into a hardware wallet.

A July 2026 report quoted Trezor's chief commercial officer defending hardware wallets as a strong self-custody option for most users, pointing to the separate screen that displays full transaction details before signing. He acknowledged that high-value holders may need layered arrangements. Hardware wallets are not invulnerable: purchase through trusted channels, verify the full address and amount on the device screen, and keep firmware current.

Microsoft's June 2026 investigation, while Windows-based, completes the picture. A crypto clipper monitored clipboard data, stole seed phrases and private keys, replaced copied wallet addresses, spread through infected USB shortcuts and used Tor for command-and-control. The countermeasure is procedural: compare the complete destination address before sending, do not trust first and last characters, and send a small test transfer first for large amounts.

The year's cases reduce to three failure points: exposed recovery phrases, deceptive downloads and unchecked transactions. No single setting closes them. Practitioners who treated any phrase entered into an untrusted app as compromised — new wallet, fresh seed, full transfer — held the only reliable position, and that standard will define exposure as the exploit chains documented this year continue circulating against unpatched devices.