suite-apps[.]xyz

This domain, suite-apps.xyz, poses as an official Apple service to distribute a crypto drainer disguised as the Exodus wallet. Victims are tricked into entering recovery phrases or private keys, leading to immediate theft of cryptocurrency assets. The site specifically targets users familiar with Apple’s ecosystem, exploiting trust in the brand to facilitate unauthorized transactions. Analysis of the page title and domain structure confirms it mimics legitimate wallet interfaces, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple red flags. The domain was registered on February 21, 2026, through Dynadot LLC, a registrar frequently abused for phishing campaigns. It currently resolves to 172.67.199.157, a Cloudflare IP address, which is commonly used to obscure malicious infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 19 out of 95 engines detecting it. Additionally, it appears on three security blocklists, including PhishDestroy and MetaMask, further confirming its malicious intent. If you visited suite-apps.xyz or interacted with its content, take immediate action. Disconnect any connected wallets from the internet and cease all transactions. Revoke permissions for any suspicious smart contracts or dApps linked to the domain. Scan your device for malware using updated security tools. If you entered recovery phrases or private keys, transfer remaining assets to a new, secure wallet immediately. Monitor all connected accounts for unauthorized activity and report the incident to relevant security teams or platforms. Users should also verify the legitimacy of any future communications claiming to be from Apple or related services.