New Shopping Snap Vulnerability: Domain Hijacking Attack Threatens Crypto Wallet Users

Security researchers have uncovered a sophisticated threat targeting the Linux Snap Store, where attackers exploit expired developer domains to compromise legitimate applications. This domain resurrection attack allows hackers to seize control of previously registered domains and deploy malicious updates through official channels, making detection extremely difficult for end users.

The Attack Mechanism: How Shopping Snap Security Fails

The threat works by hijacking expired domains associated with trusted developers, then using these compromised credentials to push poisoned versions of popular cryptocurrency wallets including Exodus, Ledger Live, and Trust Wallet. Once installed through the official Snap store, the malicious applications appear legitimate but secretly capture users’ mnemonic phrases. Two confirmed compromised domains—storewise.tech and vagueentertainment.com—have already been weaponized in this manner. The Snap mechanism’s design flaw allows attackers to inject malicious code into previously trusted software without triggering user alerts, making this particularly dangerous for less technically-savvy users.

Why This Matters for Your Digital Assets

This attack represents a critical vulnerability in the Linux software distribution model. By targeting wallet applications directly, cybercriminals can bypass traditional security measures and gain direct access to cryptocurrency holdings. The affected wallets serve millions of users globally, meaning the potential impact scope is substantial.

Protecting Yourself

Users should verify application authenticity before entering sensitive information, regularly check their domain registrations for hijacking indicators, and consider using official wallet websites rather than store-based installations when possible. As the shopping snap ecosystem continues to evolve, ongoing security audits of the Snap Store’s verification protocols remain essential to prevent similar exploits.