Solana Mobile Removes Malicious App That Sought Users’ Seed Phrases

Solana Mobile said an attacker gained unauthorized access to its publishing portal and changed parts of its dApp Store, prompting removal of a malicious app that sought users’ seed phrases.

The app, a third-party submission called “SKR Claim,” asked users to enter a seed phrase. Solana Mobile said the attacker modified the App Spotlight and Quests interfaces. The listing appeared in App Spotlight for about one hour before it was taken down.

Solana Mobile is removing the app from devices where it had been installed, a process that remains underway. The company also fixed a vulnerability that allowed links to reach apps before they were fully published in the store.

Solana Mobile cautioned that it will not ask users for seed phrases or crypto assets. The company also said users will not need to connect a wallet to claim an airdrop, a reminder relevant to the app’s request for a seed phrase.