Back Cybersecuritynews

Sophisticated SeaFlower Backdoor Campaign Targets Web3 Wallets to Steal Seed Phrases

Cybersecuritynews •Tushar Subhra Dutta • February 26, 2026

A highly sophisticated and previously unreported threat campaign dubbed SeaFlower (藏海花) has been actively targeting users of popular Web3 cryptocurrency wallets, embedding stealthy backdoors into cloned versions of legitimate applications to silently steal seed phrases and drain victims’ funds. The campaign is considered one of the most technically advanced threats to Web3 users ever documented, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SeaFlower Malware Targets Web3 Wallets to Steal Seed Phrases Cybersecurity researchers have identified a sophisticated malware campaign named SeaFlower, which is targeting users of popular Web3 cryptocurrency wallets. The malware embeds stealthy backdoors in cloned applications to silently steal seed phrases and drain victims' funds, marking it as one of the most advanced threats to Web3 users documented to date. 2 sources 27

Extracted Entities

Sophisticated SeaFlower Backdoor Campaign Targets Web3 Wallets to Steal Seed Phrases

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)