AppsFlyer Web SDK Compromised in Cryptocurrency Theft Attack

Bleepingcomputer

AppsFlyer Web SDK Compromised in Cryptocurrency Theft Attack

First seen 14 Mar 2026, 16:56 UTC • •64.5

Article Content

1 / 4

Browse articles

ThreatCluster •March 17, 2026 at 06:36 UTC

•The AppsFlyer Web SDK was hijacked to steal cryptocurrency through a supply-chain attack.
•The attack affected thousands of applications, potentially compromising user funds.
•AppsFlyer confirmed unauthorized code delivery but stated no customer data was accessed.

The AppsFlyer Web SDK was hijacked this week, allowing attackers to inject malicious code aimed at stealing cryptocurrency. The compromised SDK, utilized by over 15,000 businesses and 100,000 applications, intercepted wallet addresses entered by users and replaced them with attacker-controlled addresses. This supply-chain attack was identified by Profero researchers, who discovered obfuscated JavaScript being delivered through the SDK. The malicious payload monitored for cryptocurrency wallet input and exfiltrated original addresses while redirecting funds. The attack is believed to have occurred between March 9 and March 11, 2026. AppsFlyer confirmed a domain registrar incident on March 10, which temporarily exposed the SDK to unauthorized code. They stated that the issue has been resolved and that no customer data was accessed. Ongoing investigations are assessing the full impact of the incident.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 213d ago How this analysis works

Timeline

2026-03-09

Malicious payload discovered in AppsFlyer SDK.

2026-03-10

AppsFlyer confirmed domain registrar incident.

2026-03-11

Attack exposure window believed to have ended.

2026-03-14

BleepingComputer published details of the incident.

More articles in this cluster (3)

Threat Graph

11 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Malware
Supply Chain Attack
T1059.007 - JavaScript
T1195 - Supply Chain Compromise
T1567 - Exfiltration Over Web Service

Organization (3)

Hinge
Match Group
OkCupid

Affected Platform (2)

AppsFlyer
AppsFlyer Web SDK

Threat Actor (1)

shinyhunters

Relationships

shinyhunters uses Malware
shinyhunters uses Supply Chain Attack
shinyhunters uses T1059.007 - JavaScript
shinyhunters uses T1195 - Supply Chain Compromise
shinyhunters uses T1567 - Exfiltration Over Web Service
shinyhunters targets Hinge
shinyhunters targets Match Group
shinyhunters targets OkCupid
shinyhunters related to AppsFlyer
shinyhunters related to AppsFlyer Web SDK

Following this threat?

Track shinyhunters and Hinge in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…