Hackers Exploit Snap Domains to Inject Malicious Code into Linux Software Packages

Snaps are compressed, cryptographically signed, and revertable software packages for Linux desktops, servers, and embedded devices.

A significant security breach has been identified in the Snap Store, which is managed by Canonical. Threat actors have shifted tactics from publishing malware under new accounts to hijacking established publishers through expired domain takeovers.

This vulnerability undermines the trust signals that Linux users rely on when installing snap packages. Attackers have exploited weaknesses in account recovery mechanisms by identifying snaps published years ago by developers whose email domains have expired. Once they register these domains, they exploit the Snap Store password reset functionality, effectively taking over accounts without triggering "New Publisher" warnings or additional scrutiny.

The consequences of these takeovers are significant. Previously trustworthy snaps, with years of installation history, can now push malicious updates containing cryptocurrency wallet stealers. This creates a perception of legitimacy for users who rely on publisher longevity as a trust indicator.

Analysis indicates that the perpetrators, possibly operating from or near Croatia, are deploying fake cryptocurrency wallet applications. These applications masquerade as Exodus, Ledger Live, and Trust Wallet. The attack sequence involves requesting users to enter wallet recovery phrases, exfiltrating credentials via Telegram, displaying false errors, and emptying wallets before users detect the compromise.

Technical investigations have uncovered operational security failures, including exposure of JSON responses containing Telegram bot identifiers and usernames. The attackers subsequently removed these identifiers after they were exposed. The command-and-control URL pattern queries connectivity before requesting sensitive data, ensuring infrastructure remains operational before harvesting credentials.

Attackers have refined their obfuscation methods over time. Initial attempts relied on authentic-looking application interfaces. Later iterations employed visual homoglyph attacks, substituting Latin characters with similar-looking characters from other alphabets. Recently, attackers adopted bait-and-switch approaches, registering innocuous snap names, publishing benign applications for approval, and then pushing malicious revisions after gaining trust.

The Snap Store security model relies on community reporting, which can delay malware removal. Publishers are advised to maintain active domain registrations and enable two-factor authentication. Canonical should implement domain expiry monitoring for publisher accounts, enforce mandatory two-factor authentication for dormant accounts, and require additional verification before account recovery from lapsed domains.

Users are at risk of encountering and installing malicious applications before intervention occurs. With over 7,000 publicly published snaps and minimal barriers to publication, the attack surface is extensive. Users should avoid cryptocurrency wallet applications from any app store and instead download directly from official project websites. The gap between publication and detection remains too narrow for safe installation from untrusted sources.

Based on reporting by GBHackers.