Solana Mobile: Malicious App in dApp Store Asks Users for Seed Phrase

November 2: Solana Mobile posted on X that a malicious third-party app called "SKR Claim" was submitted to the Solana dApp Store today. After gaining unauthorized access to the dApp Publishing Portal, attackers modified the App Spotlight and Quests interfaces, and the app prompts users to enter their seed phrase. The app was displayed in dApp Spotlight for about an hour before being taken down and is now being removed from installed devices. The team has patched the vulnerability that allowed linking to apps that were not fully published, and reminded users that Solana Mobile will not ask for seed phrases or crypto assets, nor ask users to connect their wallets to claim airdrops.