Apple App Store'da iOS qurilmalari uchun avval mavjud bo'lgan Padre Terminal nomli soxta kriptovalyuta savdo ilovasi 27 ta Solana hamyonidan taxminan 23 000 dollar o'g'irlanishi bilan bog'liq.
Blokcheyn tergovchisi Iris tasdiqladiki, bir jabrlanuvchi zararli App Store ilovasi orqali buzilgan, ammo boshqa ta'sirlangan hamyonlar qanday buzilganini aniqlamagan.
Tadqiqotchi aytishicha, ilova bexabar foydalanuvchilar o'z shaxsiy kalitlarini unga import qilganidan so'ng hamyonlarni bo'shatadi.
Padre asosan Solana'da mem koinlarini sotib olish va sotish uchun ishlatiladigan kriptovalyuta savdo platformasi edi. Keyinchalik u pump.fun tomonidan Terminal deb qayta nomlandi — bu Solana blokcheynida kriptovalyuta "mem koinlari"ni yaratish, sotib olish va sotishga qaratilgan platforma.
Iris aytishicha, haqiqiy Padre savdo xizmati, hozir Terminal by pump.fun, faqat vebda ishlaydi, shuning uchun uni taqlid qiladigan har qanday mobil ilovalar, jumladan avval App Store'da mavjud bo'lgan ilova, zararli.
BleepingComputer'ning dastlabki tekshiruvi paytida biz App Store'da ikkita Padre ilovasini topdik (ID 6802739263 va ID 6717572591). Birinchisi Iris tasdiqlagan drainer ilovasi edi, ikkinchisi esa ehtimol pump.fun'ning rasmiy ilovasi bo'lib, 2024-yil oktyabridan beri faol.
App Store'dagi zararli kripto drainer ilovasi Manba: BleepingComputer
Zararli Padre Terminal ilovasi keyinchalik App Store'dan o'chirildi, uning ro'yxati endi 404 xatosini qaytaradi.
Iris BleepingComputer'ga aytdiki, u soxta ilovaning savdo interfeysi masofadan taqdim etilishini gumon qiladi, ammo hamyonni bo'shatish ekranini bevosita kuzatmagan.
Iris ma'lumotiga ko'ra, operatsiya 2026-yil 25-oktyabrdan beri 27 ta Solana hamyonini bo'shatgan va taxminan 23 000 dollar kriptovalyuta o'g'irlagan. O'g'irlangan kriptovalyuta Solana manzili 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN ga kuzatilgan.
Iris aytishicha, hujumchi 29-oktyabrda qolgan barcha USDC (4 070 token) ni SOL ga aylantirgan, bu esa Circle'ning ushbu mablag'larni muzlatish imkoniyatini yo'q qilgan.
Keyin hujumchi 192 SOL ni yangi hamyonga (H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu) o'tkazgan. Iris ma'lumotiga ko'ra, ikkita hamyon birgalikda 229,66 SOL saqlagan, tadqiqotchining yangilanishi paytida hech qanday mablag' naqdlashtirilmagan.
Drainer ilova o'chirilganidan keyin ham faol qolgan, oxirgi o'g'irlik 29-oktyabrda UTC 17:06 da sodir bo'lgan.
App Store'da yana shubhali ilovalar
Iris App Store'da kamida beshta shubhali kripto-brend taqlidchilarini aniqladi, jumladan Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools va Pump Fun Tokens & Analitycs.
Ularning ro'yxatlarida zararsiz ko'rinadigan tavsiflar mavjud, ammo foydalanuvchi sharhlari ba'zan ularning haqiqiy tabiatini ochib beradi, ko'plari ularni hamyon o'g'irlanishi va firibgarlik uchun fosh qiladi.
Masalan, Axiom Pro: Focus ilovasi fevraldan beri hamyon o'g'irlanishi haqida taxminan 25 ta foydalanuvchi sharhiga ega edi. Bir sharhlovchi ilova o'zini mem koin savdo platformasi sifatida taqdim etganini, keyin esa fokus ilovasiga aylanganini da'vo qilgan.
GMGN AI ilovasi sharhida 2 000 dollar o'g'irlangani da'vo qilingan, HyperTerminal-HyperliquidTools bilan bog'liq sharhda esa 2 020 dollar o'g'irlangani xabar qilingan.
Yana bir ilova, Pump Fun Tokens & Analitycs, o'zini eslatmalar ilovasi sifatida taqdim etgan, ammo sharhda uni kriptovalyuta o'g'irlagani aniq ayblangan.
Iris App Store'da topgan ikkita shubhali ilova Manba: BleepingComputer.com
Iris shuningdek soxta Axiom veb-saytida Axiom, Aster va GMGN taqlidchilari bilan bog'liq backend manzillarni o'z ichiga olgan skript topdi, bu umumiy operatorni ko'rsatadi. Biroq Padre Terminal bu klasterga bog'lanmagan.
Shuningdek, GMGN veb-saytidagi skript bir nechta MDH davlatlaridan tashrif buyuruvchilarni bloklaydi, bu hujumchilarning ushbu hududlardagi foydalanuvchilarni nishonga olishdan qochishga urinayotganini ko'rsatishi mumkin.
Iris to'rtta shubhali ilova uchun kriptovalyuta o'g'irlanishini mustaqil tasdiqlamagan.
BleepingComputer Apple bilan Padre draineri va App Store'da mavjud bo'lgan boshqa to'rtta shubhali ilova haqida bog'langan, ammo nashr paytida javob olmagan.
2024-yil mart oyida Apple App Store'da soxta Leather kriptovalyuta hamyon ilovasi paydo bo'lgan va bir nechta foydalanuvchi o'z hamyonlarini unga ulaganidan so'ng aktivlarini yo'qotganini xabar qilgan.
Apple oxir-oqibat ilovani ikki hafta o'tib o'chirgan va nashriyotni o'z dasturchi dasturidan bloklagan.
Foydalanuvchilarga loyihalarning rasmiy veb-saytlaridan App Store'ga havolalarni kuzatish va faqat bir nechta yuklab olish va sharhlarga ega ilovalarni, yoki loyihaga butunlay bog'liq bo'lmagan nomlar bilan nashr etilgan ilovalarni o'rnatishdan qochish tavsiya etiladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga himoyalarni o'lchaydi.
Hisobotni oling
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets.
Blockchain investigator Iris confirmed that one victim was compromised through the malicious App Store app, but has not determined how the other affected wallets were compromised.
The researcher says the app drains wallets after unsuspecting users import their private keys into it.
Padre was a cryptocurrency trading platform, mainly used to buy and sell meme coins on Solana. It was later renamed Terminal by pump.fun, a platform focused on creating, buying, and selling cryptocurrency “meme coins” on the Solana blockchain.
Iris says the legitimate Padre trading service, now Terminal by pump.fun, is web-only, so any mobile apps impersonating it, including the one previously available on the App Store, are malicious.
At the time of BleepingComputer's initial investigation, we found two Padre apps on the App Store (ID 6802739263 and ID 6717572591). The former was the Iris-confirmed drainer app, while the latter is likely pump.fun's official app, live since October 2024.
The malicious crypto drainer app on the App Store Source: BleepingComputer
The malicious Padre Terminal app has since been removed from the App Store, with its listing now returning a 404 error.
Iris told BleepingComputer it suspects the trading interface of the fake app is served remotely, but has not directly observed the wallet-draining screen.
According to Iris, the operation has drained 27 Solana wallets since October 25, 2026, stealing approximately $23,000 in cryptocurrency. The stolen cryptocurrency was traced to the Solana address3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN.
Iris says the attacker converted all remaining USDC (4,070 tokens) into SOL on October 29, eliminating the possibility of Circle freezing those funds.
The attacker then transferred 192 SOL to a new wallet (H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu). According to Iris, the two wallets held a combined 229.66 SOL, with no funds cashed out at the time of the researcher's update.
The drainer remained active after the app's removal, with the latest reported theft occurring at 17:06 UTC on October 29.
More suspicious apps on the App Store
Iris identified at least five suspected crypto-brand impersonators on the App Store, including Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs.
Their listings feature seemingly harmless descriptions, but user reviews below sometimes reveal their true nature, with many exposing them for wallet theft and scams.
The Axiom Pro: Focus app, for example, had approximately 25 user reviews alleging wallet theft since February. One reviewer claimed the app had presented itself as a meme coin trading platform before changing into a focus application.
A review of the GMGN AI app alleged that $2,000 had been stolen, while a review associated with HyperTerminal-HyperliquidTools reported the theft of $2,020.
Another app, Pump Fun Tokens & Analitycs, presented itself as a notes application but had a review explicitly accusing it of stealing cryptocurrency.
Two suspicious apps Iris discovered on the App Store Source: BleepingComputer.com
Iris also found a script on the fake Axiom website containing backend addresses associated with Axiom, Aster, and GMGN impersonators, suggesting a common operator. However, Padre Terminal was not linked to that cluster.
Also, a script on the GMGN website blocks visitors from several CIS countries, potentially indicating that the attackers are attempting to avoid targeting users in those regions.
Iris has not independently confirmed cryptocurrency theft for the four suspicious apps.
BleepingComputer has contacted Apple about the Padre drainer and the other four suspicious apps available on the App Store, but we have not heard back as of publication.
In March 2024, a fake Leather cryptocurrency wallet app appeared on the Apple App Store, and multiple users reported losing their assets after connecting their wallets to it.
Apple eventually removed the app two weeks later and blocked the publisher from its developer program.
Users are recommended to follow links to the App Store from the projects' official websites and avoid installing apps with only a handful of downloads and reviews, or those published by entities with names that appear completely unrelated to the project.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
