AppsFlyer SDK Compromised with Crypto-Stealing Code
AppsFlyer's Web SDK was hijacked on March 14, 2026, when attackers injected malicious JavaScript designed to steal cryptocurrency from users' digital wallets. The supply chain attack targeted the popular mobile attribution platform's web-based software development kit.
The compromise was discovered within hours of the malicious code being deployed. AppsFlyer immediately removed the infected version and restored clean SDK files to prevent further damage to applications using their service.
Mobile Apps Using AppsFlyer Web SDK at Risk
Any mobile application or website integrating AppsFlyer's Web SDK during the compromise window was potentially affected. The malicious code specifically targeted users with cryptocurrency wallets, attempting to extract private keys and wallet credentials.
AppsFlyer serves thousands of mobile app developers worldwide, making this supply chain attack particularly concerning for the broader mobile ecosystem. The exact number of affected applications hasn't been disclosed.
Cryptocurrency Theft Vector and Response
The injected code scanned for popular cryptocurrency wallet extensions and attempted to harvest sensitive authentication data. Security researchers identified the malicious payload as part of a broader campaign targeting software supply chains.
AppsFlyer has advised all developers using their Web SDK to update to the latest clean version immediately. The company is working with CISA to track similar supply chain compromises. Organizations should audit their SDK dependencies and implement supply chain security measures to prevent future attacks.
