- SparkKitty scans photographs and makes use of OCR to steal restoration phrases for cryptocurrency wallets.
- Malicious apps powered by SparkKitty had been listed on the App Retailer and Google Play earlier than being eliminated.
- Researchers warned that faux pockets apps might expose customers’ restoration phrases.
The SparkKitty malware marketing campaign has emerged as a safety concern after researchers found a malicious utility that focused the restoration phrases of cryptocurrency wallets saved in customers’ photograph libraries. The malware affected each iOS and Android gadgets by functions distributed on the Apple App Retailer and Google Play.
As soon as the person granted entry to the photographs, the malware used optical character recognition (OCR) to scan the saved pictures for the pockets restoration phrase earlier than sending the extracted information to attacker-controlled servers, cybersecurity researchers mentioned.
SparkKitty malware relied on accessing photograph libraries
Researchers mentioned the marketing campaign labored by exploiting permissions that many customers routinely approve when putting in apps. Somewhat than making an attempt to seize passwords by conventional strategies equivalent to keystroke logging, SparkKitty centered on pictures already saved on contaminated gadgets.
Kaspersky Lab, which documented the malware in June 2025, mentioned SparkKitty developed from an earlier SparkCat marketing campaign. As soon as put in, the affected utility requests entry to the person’s photograph library and repeatedly scans for each current and newly saved pictures.
Utilizing OCR expertise, the malware particularly looked for 12-word and 24-word crypto pockets restoration phrases earlier than transferring the extracted data and fundamental gadget particulars to an attacker-controlled command-and-control server.
Researchers determine malicious functions
As researchers investigated the assault additional, they recognized a number of functions carrying the malware in official app shops. Kaspersky Lab cited the “Kancoin” utility and SOEX because the affected apps, which had greater than 10,000 downloads earlier than being eliminated.
After being alerted by researchers, each Apple and Google eliminated the recognized functions from their respective app shops.
Examine Level additionally investigated this malware and concluded that SparkKitty shares the identical OCR-based method beforehand seen in SparkCat. In response to the corporate’s report, the malware not solely searched screenshots for cryptocurrency restoration phrases, but in addition passwords and QR code information saved within the pictures.
Following the findings, investor Evan Luthra issued a public alert highlighting how the attackers mixed the malware with a fraudulent pockets utility. He mentioned researchers additionally recognized 26 faux pockets apps on the Apple App Retailer that replicated cryptocurrency wallets utilizing comparable logos and slight spelling modifications.
In response to his assertion, customers who enter restoration phrases into these functions could unknowingly go their pockets credentials to attackers.
Associated: Microsoft flags two malicious npm packages focusing on cryptocurrency wallets
Disclaimer: The knowledge contained on this article is for informational and academic functions solely. This text doesn’t represent monetary recommendation or recommendation of any sort. Coin Version will not be accountable for any losses incurred because of using the content material, merchandise, or companies talked about. We encourage our readers to conduct due diligence earlier than taking any motion associated to our firm.