Solana Mobile patches bug after malicious app appears in dApp Portal

A fake airdrop app called 'SKR Claim' spent one hour in the App Spotlight before Solana Mobile pulled it and pushed a security fix. Solana Mobile had a rough morning on November 1 when a malicious application briefly made it into the App Spotlight of its decentralized app store. The app, named ‘SKR Claim,’ was live for approximately one hour before the company yanked it, patched the underlying vulnerability, and began removing it from affected user devices. The core issue: someone gained unauthorized access to the dApp Publishing Portal and used that access to surface an unpublished app in a curated section of the store. The bug that made this possible allowed apps that had never been formally published to appear in spotlight features, which are the kind of prime placement users tend to trust. What the malicious app actually did ‘SKR Claim’ was designed to collect seed phrases from users who believed they were claiming an airdrop. Seed phrases are the master keys to crypto wallets. Handing one over to a fake app is the digital equivalent of giving a stranger your bank PIN, your passwords, and a spare house key, all at once. Solana Mobile was direct about the company’s own practices...