Executive Summary
On March 9, 2026, Profero began investigating a suspected compromise of the AppsFlyer SDK following customer requests. AppsFlyer is a mobile attribution and marketing analytics platform integrated into thousands of applications. The investigation confirmed that the SDK delivered obfuscated malicious JavaScript alongside legitimate code — a cryptocurrency wallet hijacker that intercepted addresses and replaced them with attacker-controlled values.
While the full scope remains unverified, the incident demonstrates how threat actors exploit trust in third-party SDKs. AppsFlyer has acknowledged an “availability issue” but provided no official confirmation of the compromise.
AppsFlyer Web SDK Vulnerability
Profero observed the AppsFlyer Web SDK, sourced from websdk[.]appsflyer[.]com, serving obfuscated malicious code. Potentially affected parties include organizations embedding the Web SDK and users visiting affected sites.
Payload Analysis
The malicious payload operated through these mechanisms:
- Loads and decodes obfuscated strings at runtime
- Installs hooks into browser network requests
- Monitors pages for wallet-related input activity
- Identifies cryptocurrency addresses
- Replaces legitimate addresses with attacker wallets
- Exfiltrates original addresses and metadata
Targeted wallet types included: Bitcoin, Ethereum, Solana, Ripple, and TRON.
Attacker Infrastructure
Profero identified three primary endpoints:
websdk[.]appsflyer[.]com/v1/api/plugin— fetches attacker-controlled wallet addresseswebsdk[.]appsflyer[.]com/v1/api/process— receives exfiltrated datawebsdk[.]appsflyer[.]com/v1/api/process?rd=— telemetry/exfiltration endpoint
The payload contained hardcoded fallback wallets that the attacker could update remotely for operational persistence and wallet rotation.
Attacker Wallets
- ETH:
0x1C069d0c73087D0Bae687a6f74a807350dCe1829 - BTC:
bc1qr7ngtnsh66demm4vzt4kmqxkqj8sqprnuklalt - SOL:
4LJi6mAczxZWbUvbMEk5scKhUZNPvfMDTjaVADkPFSsK - XRP:
rntqwheGbZihkabxf6xqZkUKGfTVyRhT14 - TRX:
TV6WtAkS4aAMJb3Rt2bfs8LxggF8Kmqbd9
Detection Guidance
Organizations should:
- Identify websites using the AppsFlyer Web SDK
- Review logs for connections to
websdk[.]appsflyer[.]comand associated URLs - Validate SDK files loaded between March 9 (~22:45 UTC) and March 11
- Investigate user reports of failed or misdirected cryptocurrency transactions
IOCs
- Domains/URLs:
websdk[.]appsflyer[.]comand associated API endpoints - Wallet Addresses: five cryptocurrency wallets across multiple blockchain networks (listed in Attacker Wallets above)