{
  "name": "FakeWallet crypto stealer spreading in the App Store",
  "slug": "fakewallet-crypto-stealer-spreading-in-the-app-store",
  "description": "In March 2026, over twenty phishing applications were discovered in the Apple App Store masquerading as popular cryptocurrency wallets. These malicious apps redirect users to browser pages that distribute trojanized versions of legitimate wallets designed to steal recovery phrases and private keys. The campaign primarily targets users in China, exploiting regional restrictions that prevent official crypto wallet apps from being available in the Chinese App Store. Attackers use typosquatting and fake promotional materials to deceive users. The infected applications leverage iOS enterprise provisioning profiles for distribution and employ various techniques including malicious library injection and source code modification. The campaign has been active since at least fall 2025 and targets major wallets including MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie. Some infected apps also contained SparkKitty modules, suggesting potential links between threat actors.",
  "published": "2026-04-20T10:25:55.404000+00:00",
  "created_at": "2026-04-20T11:52:56.634000+00:00",
  "modified_at": "2026-04-20T14:54:55+00:00",
  "created_at_opencti": "2026-04-20T11:52:56.634000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "chinese targeting",
    "cryptocurrency",
    "enterprise certificates",
    "fakewallet",
    "ios",
    "phishing apps",
    "provisioning profiles",
    "sparkkitty",
    "app store",
    "credential theft",
    "cryptocurrency wallet"
  ],
  "tags": [
    "2026-04-20",
    "app store",
    "chinese targeting",
    "credential-theft",
    "cryptocurrency",
    "cryptocurrency wallet",
    "enterprise certificates",
    "fakewallet",
    "ios",
    "phishing apps",
    "provisioning profiles",
    "sparkkitty"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "2a493435-b14b-44c4-bc14-edde9b44e434",
        "name": "https://appstoreios.com/DjZH?key=646556306F6Q465O313L737N3332939Y353I830F31"
      },
      {
        "id": "e65a23f6-fa8b-48d4-9a3c-0ceddd8eb41d",
        "name": "https://kkkhhhnnn.com/api/open/postByTokenpocket"
      },
      {
        "id": "0153204d-7788-41dc-a9be-4bd37ee603c3",
        "name": "https://helllo2025.com/api/open/postByTokenpocket"
      },
      {
        "id": "70107301-7a10-4298-bbc8-99a9449d443a",
        "name": "https://www.gxzhrc.cn/download/"
      },
      {
        "id": "deef8853-d37c-4dc5-ab3e-1cdd6bb2e66f",
        "name": "crypto-stroe.cc"
      },
      {
        "id": "2732a53e-a135-4806-88e2-6792d10489b1",
        "name": "https://api.npoint.io/153b165a59f8f7d7b097"
      },
      {
        "id": "8b9a6af6-8991-419f-8876-14c8c2365926",
        "name": "https://nmu8n.com/tpocket/ios/Rsakeyword.php"
      },
      {
        "id": "c9333eb3-7d38-430b-8446-056256a37bc3",
        "name": "https://zdrhnmjjndu.ulbcl.com/tWe0ASmXJbDz3KGh?4a1bbe6d=31d25ddf2697b9e13ee883fff328b22f"
      },
      {
        "id": "c81d8d22-e382-45f1-8b72-efb53a059070",
        "name": "https://yjzhengruol.com/s/3f605f"
      },
      {
        "id": "1f5663e7-a48b-4676-813a-bd5306279065",
        "name": "https://xz.apps-store.im/s/dDan?key=646756376F6A465D313L737J333993473233038L39&c="
      },
      {
        "id": "8224414d-1971-4fe6-8632-580c656aa8c5",
        "name": "https://crypto-stroe.cc/"
      },
      {
        "id": "67d6245c-2c81-4249-bbeb-21a6530d2605",
        "name": "https://xz.apps-store.im/s/iuXt?key=646Y563Y6F6H465J313X737U333S9342323N030R34&c="
      },
      {
        "id": "5b50f27e-f425-41b5-8829-fda395307aca",
        "name": "https://ngy2yjq0otlj.ahroar.com/17pIWJfr9DBiXYrSb"
      },
      {
        "id": "8a59b0f1-3301-49b1-b343-31b78a9a8a6f",
        "name": "api.dc1637.xyz"
      },
      {
        "id": "54ffce84-98b1-4676-8efe-f79452b6f3f1",
        "name": "mti4ywy4.lahuafa.com"
      },
      {
        "id": "a7416c14-848b-46fe-a84f-8d3608b1194d",
        "name": "nziwytu5n.lahuafa.com"
      },
      {
        "id": "0e21736f-10f4-4228-ac33-a6d65fd300b9",
        "name": "https://ngy2yjq0otlj.ahroar.com/EpCXMKDMx1roYGJ"
      },
      {
        "id": "e843ebd6-032c-46d1-bed5-a1d660914253",
        "name": "mtjln.siyangoil.com"
      },
      {
        "id": "025d8d8b-6f2e-4e91-b340-5cf1f1d86213",
        "name": "zdrhnmjjndu.ulbcl.com"
      },
      {
        "id": "7b890dd5-8286-461f-b397-e65f62e08771",
        "name": "https://mtjln.siyangoil.com/08dT284P/1ZMz5Xmb0EoQZVvS5"
      },
      {
        "id": "9a27426b-db74-4971-a256-465ef6950d65",
        "name": "https://ntm0mdkzymy3n.oukwww.com/7nhn7jvv5YieDe7P?0e7b9c78e=686989d97cf0d70346cbde2031207cbf"
      },
      {
        "id": "d1e89565-7dec-43cb-92cf-ca032aabd4f1",
        "name": "ntm0mdkzymy3n.oukwww.com"
      },
      {
        "id": "dfdc30b8-5e6f-44e9-89e8-f096d30fe180",
        "name": "https://zmx6f.com/btp/ios/receiRsakeyword.php"
      },
      {
        "id": "a199b908-1926-4971-9ada-ed3473aadd2a",
        "name": "www.gxzhrc.cn"
      },
      {
        "id": "f59641a5-c0a3-4dd1-adb0-700ce88a1410",
        "name": "iosfc.com"
      },
      {
        "id": "f856bfeb-c2bd-4979-8b12-84091322b2d9",
        "name": "https://139.180.139.209/prod-api/system/confData/getUserConfByKey/"
      },
      {
        "id": "4bd51a6a-b838-4061-89b2-8b59062da405",
        "name": "https://xz.apps-store.im/CqDq?key=646R563V6F6Y465K313J737G343C3352383R336O35"
      },
      {
        "id": "38f23c33-6687-4667-a936-f95d7ae97646",
        "name": "https://mti4ywy4.lahuafa.com/UVB2U/mw2ZmvXKUEbzI0n"
      },
      {
        "id": "50da1c04-e71a-4bb2-a78c-ab0f6b4ea61f",
        "name": "https://mziyytm5ytk.ahroar.com/kAN2pIEaariFb8Yc"
      },
      {
        "id": "79351036-4da9-4f75-b2e8-5deaa43adebc",
        "name": "https://odm0.siyangoil.com/TYTmtV8t/JG6T5nvM1AYqAcN"
      },
      {
        "id": "70bafbee-2f86-42e1-85bd-13fe316fbceb",
        "name": "mziyytm5ytk.ahroar.com"
      },
      {
        "id": "4504f805-4768-45a6-a977-0bba54c0b590",
        "name": "helllo2025.com"
      },
      {
        "id": "2af725ae-684a-4b6d-8f4a-e984ec53a0ed",
        "name": "https://6688cf.jhxrpbgq.com/6axqkwuq"
      },
      {
        "id": "6ab35ffc-472f-45c2-b903-05306dc991c0",
        "name": "https://ntm0mdkzymy3n.oukwww.com/jFms03nKTf7RIZN8?61f68b07f8=0565364633b5acdd24a498a6a9ab4eca"
      },
      {
        "id": "b2ee74e6-227b-4a02-b21c-d48a054f5b00",
        "name": "https://iosfc.com/ledger/ios/Rsakeycatch.php"
      },
      {
        "id": "d7015d79-8c4f-4192-b3b9-2ad29ce16553",
        "name": "kkkhhhnnn.com"
      },
      {
        "id": "12dc0a3a-f227-43e2-bce7-0c95f0ab9dbf",
        "name": "https://sxsfcc.com/api/open/postByTokenpocket"
      },
      {
        "id": "abf0f6f4-660c-42e5-8f36-13d56b32e606",
        "name": "https://api.dc1637.xyz"
      },
      {
        "id": "def94cbe-c1a8-4d1a-b512-dae5adf2f2d9",
        "name": "nmu8n.com"
      },
      {
        "id": "34320927-3054-4afd-923e-9eb577e52987",
        "name": "https://xz.apps-store.im/DjZH?key=646B563L6F6N4657313B737U3436335E3833331737"
      },
      {
        "id": "a1dc873f-90b0-4d67-a5e9-f38e42d65273",
        "name": "https://nziwytu5n.lahuafa.com/10RsW/mw2ZmvXKUEbzI0n"
      },
      {
        "id": "9692507f-bb5f-433d-8c9f-d150bf9a9734",
        "name": "xz.apps-store.im"
      },
      {
        "id": "db662d48-bdc1-47fb-b382-7e1d5dc9b182",
        "name": "mgi1y.siyangoil.com"
      },
      {
        "id": "836872cd-b5f2-4dd5-b532-f95b74ccd4e6",
        "name": "https://zdrhnmjjndu.ulbcl.com/7uchSEp6DIEAqux?a3f65e=417ae7f384c49de8c672aec86d5a2860"
      },
      {
        "id": "b21e1d12-e92e-4962-87e2-c907d6a1dfe5",
        "name": "sxsfcc.com"
      },
      {
        "id": "92241c55-3926-46dc-9d7e-5576eac09e56",
        "name": "ngy2yjq0otlj.ahroar.com"
      },
      {
        "id": "cbbc1279-8074-491e-aa25-d1814bac444a",
        "name": "odm0.siyangoil.com"
      },
      {
        "id": "495e6464-c4b3-448c-89bd-6ab087c83053",
        "name": "6688cf.jhxrpbgq.com"
      },
      {
        "id": "e1c90dcd-c4a0-4b14-9f67-09d7fbb3f9c6",
        "name": "zmx6f.com"
      },
      {
        "id": "5373fe82-099e-4603-a41e-7556885ee573",
        "name": "yjzhengruol.com"
      },
      {
        "id": "837b45ae-7b6e-4d3a-98ee-22c1f855575c",
        "name": "appstoreios.com"
      },
      {
        "id": "450e1f79-2e45-4b21-83b0-b85954f15818",
        "name": "https://mgi1y.siyangoil.com/vmzLvi4Dh/1Dd0m4BmAuhVVCbzF"
      },
      {
        "id": "4eb732a8-a199-4a0f-bf97-a111b51db639",
        "name": "ce5cb685b831d3eec4c86ca50b110827e7ad1f0e4fec41c4e4f87dcd97f262cb"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "5fbd38af-69a3-49b9-9ff4-e7ab3e59bd12",
        "name": "T1534"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "02abb0a8-0ebf-433b-987f-e25675af60d6",
        "name": "T1055.001"
      },
      {
        "id": "7e3e3784-9547-42ca-b888-482972d14be3",
        "name": "T1528"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "52f731f8-22b9-4a53-87eb-35a6738f7a1b",
        "name": "T1036.001"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "64e548d5-24de-4894-9c90-c6e17b3b3bee",
        "name": "T1056.002"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "6aa7866f-9c1f-4159-938a-10a6adf41646",
        "name": "T1553"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "75479c31-f979-4d0f-a0f8-4f450587fdb5",
        "name": "SparkKitty",
        "slug": "sparkkitty"
      },
      {
        "id": "74b7799b-9da4-4d28-82fc-35df31125b5d",
        "name": "FakeWallet",
        "slug": "fakewallet"
      }
    ],
    "observables": [
      {
        "id": "85289cee-315f-4014-b0c3-90bb7dfd672e",
        "name": "yjzhengruol.com"
      },
      {
        "id": "360860d7-84e7-4712-a1d4-2f04b3f5e506",
        "name": "iosfc.com"
      },
      {
        "id": "4bdf66db-f4fd-411e-abf0-86111b6d72a0",
        "name": "helllo2025.com"
      },
      {
        "id": "77e99130-a577-48c8-b7cd-278d65459ec9",
        "name": "sxsfcc.com"
      },
      {
        "id": "3ca3b1f5-36d3-4ccd-9888-b4aa98d7b6b0",
        "name": "kkkhhhnnn.com"
      },
      {
        "id": "ecc39706-b091-4dc6-aa5c-54adb4d49a9a",
        "name": "crypto-stroe.cc"
      },
      {
        "id": "9989c39d-f521-419f-b72c-d2d416e825a3",
        "name": "appstoreios.com"
      },
      {
        "id": "2a8bd847-edba-46e5-ba86-1aa059df4efd",
        "name": "nmu8n.com"
      },
      {
        "id": "1777c1a9-72d9-4287-b2c5-ec8e42167339",
        "name": "zmx6f.com"
      },
      {
        "id": "401cfaef-a237-400c-a744-8e465097279b",
        "name": "mgi1y.siyangoil.com"
      },
      {
        "id": "da1bbfb3-2631-441c-87c9-44776cc2ff69",
        "name": "nziwytu5n.lahuafa.com"
      },
      {
        "id": "bfe9dc2a-a353-43f6-8716-2b4e51c89efb",
        "name": "mti4ywy4.lahuafa.com"
      },
      {
        "id": "e3fc79e5-514e-431e-95a7-04fa10ad2ae9",
        "name": "zdrhnmjjndu.ulbcl.com"
      },
      {
        "id": "4a2ffcd8-279f-4feb-a8a8-f4ef7f2e2ba0",
        "name": "xz.apps-store.im"
      },
      {
        "id": "b40c5be6-a866-42f2-b381-b6bacc0a2b95",
        "name": "mtjln.siyangoil.com"
      },
      {
        "id": "451f2c38-4522-436d-9e46-d9de6a04e941",
        "name": "www.gxzhrc.cn"
      },
      {
        "id": "bcdf5ccc-b714-43a4-a4de-d0b1aed33889",
        "name": "ngy2yjq0otlj.ahroar.com"
      },
      {
        "id": "dd9af89f-2753-4d5d-8909-f8452ed84be6",
        "name": "odm0.siyangoil.com"
      },
      {
        "id": "71645099-d5fd-4f75-a1e3-e2c8c637754e",
        "name": "6688cf.jhxrpbgq.com"
      },
      {
        "id": "dc12f7a3-6f08-4567-9a89-7b6757f92c52",
        "name": "ntm0mdkzymy3n.oukwww.com"
      },
      {
        "id": "56964c09-879e-4d92-8086-fd46dfb1dd23",
        "name": "mziyytm5ytk.ahroar.com"
      },
      {
        "id": "5a5d909c-f5c2-4ef0-ae01-39a79f24f7eb",
        "name": "api.dc1637.xyz"
      },
      {
        "id": "39ca6092-4126-45a3-9070-61686d03fd10",
        "name": "https://sxsfcc.com/api/open/postByTokenpocket"
      },
      {
        "id": "80eb77ea-78be-48b2-aaf4-22f09a67bbc7",
        "name": "https://kkkhhhnnn.com/api/open/postByTokenpocket"
      },
      {
        "id": "cc11695e-748a-44e5-ba69-9747a8f1967c",
        "name": "https://xz.apps-store.im/CqDq?key=646R563V6F6Y465K313J737G343C3352383R336O35"
      },
      {
        "id": "9942dc83-eb0f-4a1b-b498-b1e9a8c27456",
        "name": "https://xz.apps-store.im/s/dDan?key=646756376F6A465D313L737J333993473233038L39&c="
      },
      {
        "id": "431de49d-19a7-496c-9b67-b95920cd0836",
        "name": "https://ngy2yjq0otlj.ahroar.com/EpCXMKDMx1roYGJ"
      },
      {
        "id": "5e38f463-e0da-4172-a594-7245c1403684",
        "name": "https://zmx6f.com/btp/ios/receiRsakeyword.php"
      },
      {
        "id": "17c9c67b-71ac-464f-8961-97e4e691d041",
        "name": "https://odm0.siyangoil.com/TYTmtV8t/JG6T5nvM1AYqAcN"
      },
      {
        "id": "276bacfa-59b0-4336-9b2f-d31b32578691",
        "name": "https://xz.apps-store.im/DjZH?key=646B563L6F6N4657313B737U3436335E3833331737"
      },
      {
        "id": "87390095-bd76-4693-8b36-b41e147d6d3a",
        "name": "https://zdrhnmjjndu.ulbcl.com/7uchSEp6DIEAqux?a3f65e=417ae7f384c49de8c672aec86d5a2860"
      },
      {
        "id": "5f9b6e3e-e7aa-4a36-b614-d3458270d574",
        "name": "https://mtjln.siyangoil.com/08dT284P/1ZMz5Xmb0EoQZVvS5"
      },
      {
        "id": "f5c10b7e-7ee6-4bc9-92db-3948a5a71837",
        "name": "https://ngy2yjq0otlj.ahroar.com/17pIWJfr9DBiXYrSb"
      },
      {
        "id": "763f5e5b-07ce-4082-84ab-cc1735de08fe",
        "name": "https://appstoreios.com/DjZH?key=646556306F6Q465O313L737N3332939Y353I830F31"
      },
      {
        "id": "cdc16544-9243-4109-85c0-7e7d7822b023",
        "name": "https://mgi1y.siyangoil.com/vmzLvi4Dh/1Dd0m4BmAuhVVCbzF"
      },
      {
        "id": "2b00cabd-ce43-4ed4-b735-0ad991f47c0b",
        "name": "https://mti4ywy4.lahuafa.com/UVB2U/mw2ZmvXKUEbzI0n"
      },
      {
        "id": "6fc1cdec-6dd9-42c2-a55a-6cfe53cf0725",
        "name": "https://helllo2025.com/api/open/postByTokenpocket"
      },
      {
        "id": "e403fab2-a03d-4ac4-bb81-fe5ec93738b6",
        "name": "https://crypto-stroe.cc/"
      },
      {
        "id": "d2ba92c4-24c6-4fe4-8550-888795022553",
        "name": "https://zdrhnmjjndu.ulbcl.com/tWe0ASmXJbDz3KGh?4a1bbe6d=31d25ddf2697b9e13ee883fff328b22f"
      },
      {
        "id": "bbe8d03e-7d70-4b80-a371-9e8f9cc0b06e",
        "name": "https://www.gxzhrc.cn/download/"
      },
      {
        "id": "e85d3d7c-8ede-44aa-ac1a-536e510c8a02",
        "name": "https://139.180.139.209/prod-api/system/confData/getUserConfByKey/"
      },
      {
        "id": "1bf4e373-ae82-4a4b-83fa-12ffa8ad879c",
        "name": "https://xz.apps-store.im/s/iuXt?key=646Y563Y6F6H465J313X737U333S9342323N030R34&c="
      },
      {
        "id": "0f62aee1-e111-4fe3-ab62-d0e332a2a7fa",
        "name": "https://iosfc.com/ledger/ios/Rsakeycatch.php"
      },
      {
        "id": "6aa566a4-6470-47e6-a9bf-946689a7b5f3",
        "name": "https://nziwytu5n.lahuafa.com/10RsW/mw2ZmvXKUEbzI0n"
      },
      {
        "id": "dbba13a5-c533-447d-bb79-3bf4ed09ff3b",
        "name": "https://mziyytm5ytk.ahroar.com/kAN2pIEaariFb8Yc"
      },
      {
        "id": "54699c56-c8a5-4950-92d4-7a12064896d0",
        "name": "https://api.npoint.io/153b165a59f8f7d7b097"
      },
      {
        "id": "867149bb-5e86-4052-93a7-0e844641919b",
        "name": "https://6688cf.jhxrpbgq.com/6axqkwuq"
      },
      {
        "id": "4f22f035-7a43-4ee0-b5db-fb363ce537f1",
        "name": "https://ntm0mdkzymy3n.oukwww.com/jFms03nKTf7RIZN8?61f68b07f8=0565364633b5acdd24a498a6a9ab4eca"
      },
      {
        "id": "ddb09f37-9269-4603-ae30-1816b1de0b6b",
        "name": "https://nmu8n.com/tpocket/ios/Rsakeyword.php"
      },
      {
        "id": "0e8c4aad-2792-45f6-b6da-d555c4f9d59a",
        "name": "https://ntm0mdkzymy3n.oukwww.com/7nhn7jvv5YieDe7P?0e7b9c78e=686989d97cf0d70346cbde2031207cbf"
      },
      {
        "id": "917d3826-a488-4fdb-a13a-f4b333fdbf25",
        "name": "https://api.dc1637.xyz"
      },
      {
        "id": "cdd49aa8-7e98-4ca5-98c6-98dbf285026a",
        "name": "https://yjzhengruol.com/s/3f605f"
      },
      {
        "id": "",
        "name": "ce5cb685b831d3eec4c86ca50b110827e7ad1f0e4fec41c4e4f87dcd97f262cb"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "crypto-stroe.cc"
      },
      {
        "id": "",
        "name": "api.dc1637.xyz"
      },
      {
        "id": "",
        "name": "mti4ywy4.lahuafa.com"
      },
      {
        "id": "",
        "name": "nziwytu5n.lahuafa.com"
      },
      {
        "id": "",
        "name": "mtjln.siyangoil.com"
      },
      {
        "id": "",
        "name": "zdrhnmjjndu.ulbcl.com"
      },
      {
        "id": "",
        "name": "ntm0mdkzymy3n.oukwww.com"
      },
      {
        "id": "",
        "name": "iosfc.com"
      },
      {
        "id": "",
        "name": "mziyytm5ytk.ahroar.com"
      },
      {
        "id": "",
        "name": "helllo2025.com"
      },
      {
        "id": "",
        "name": "kkkhhhnnn.com"
      },
      {
        "id": "",
        "name": "nmu8n.com"
      },
      {
        "id": "",
        "name": "xz.apps-store.im"
      },
      {
        "id": "",
        "name": "mgi1y.siyangoil.com"
      },
      {
        "id": "",
        "name": "sxsfcc.com"
      },
      {
        "id": "",
        "name": "ngy2yjq0otlj.ahroar.com"
      },
      {
        "id": "",
        "name": "odm0.siyangoil.com"
      },
      {
        "id": "",
        "name": "6688cf.jhxrpbgq.com"
      },
      {
        "id": "",
        "name": "zmx6f.com"
      },
      {
        "id": "",
        "name": "yjzhengruol.com"
      },
      {
        "id": "",
        "name": "appstoreios.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "2ec7f6d0-c3be-48f7-b4c8-8bdbc4cb66ed",
      "standard_id": "external-reference--60fee057-cadc-5126-b96e-3a662c434715",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://securelist.com/fakewallet-cryptostealer-ios-app-store/119482/",
      "hash": null,
      "external_id": null,
      "created": "2026-04-20T11:52:54.555Z",
      "modified": "2026-04-20T11:52:54.555Z",
      "createdById": null
    },
    {
      "id": "f35214f1-0d94-46a5-bc53-f341799a770c",
      "standard_id": "external-reference--6df24e24-c2a5-534e-9c65-6d07a3f31649",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69e5ff33953b2bfaa5b6c105",
      "hash": null,
      "external_id": "69e5ff33953b2bfaa5b6c105",
      "created": "2026-04-20T11:52:54.519Z",
      "modified": "2026-04-20T11:52:54.519Z",
      "createdById": null
    },
    "https://otx.alienvault.com/pulse/69e64149d8dcee0acea28f7f",
    "https://securelist.com/fakewallet-cryptostealer-ios-app-store/119474/"
  ]
}