SlowMist Discovers 'Future Attack' in Linux Store

Cybersecurity firm SlowMist has identified a new method of attack targeting Linux users through the official Snap Store, wherein attackers exploit expired domains to steal cryptocurrency wallet recovery phrases. This alarming discovery was made by the company's head of information security, known as 23pds.

Linux users should be cautious: a new attack in the Snap Store allows hackers to exploit expired domains to access crypto assets. Modified apps disguised as popular wallets, such as Exodus and Ledger Live, trick users into entering sensitive information, leading to stolen funds.

— 23pds (山哥) (@im23pds) January 21, 2026

The attackers register expired domains that are linked to developer accounts within the Snap Store, allowing them to gain unnoticed control over these accounts. Through this approach, they can push updates to already installed software on victims' devices, embedding harmful code within these updates.

Compromised applications then pose as well-known crypto wallets, prompting users to enter their recovery mnemonic phrases, which are subsequently sent to the attackers.

SlowMist has flagged two specific domains involved in these activities: "storewise[.]tech" and "vagueentertainment[.]com." This incident highlights a concerning trend where cyber threats are shifting away from direct attacks on smart contracts toward targeting the very infrastructure and distribution channels trusted by users.

In a related incident from late December, hackers had previously inserted malicious code into an update for Trust Wallet on Chrome, affecting over 2,500 addresses and leading to $8.5 million in losses. This breach was tied to a larger supply chain attack from November, where hackers accessed developers' sensitive data on GitHub.

The rising threat to the crypto sector is underscored by data showing that hackers stole more than $3.4 billion in cryptocurrencies in 2025 alone, as reported by Chainalysis.