Solana Mobile said a malicious third-party app called “SKR Claim” was submitted to its dApp Store and asked users to enter their seed phrases. According to ChainCatcher, an attacker gained unauthorized access to the dApp publishing portal and changed the App Spotlight and Quests interfaces. The app appeared in dApp Spotlight for about one hour before being removed, and the team is removing it from devices where it was installed. Solana Mobile said it fixed a vulnerability that allowed links to apps that had not been fully released. The company also said it will not ask users for seed phrases or crypto assets, or require them to connect a wallet to claim an airdrop.