SparkKitty malware scans mobile photos for crypto wallet seed phrases

SparkKitty is a cross-platform malware family that scans photos on Android and iOS devices for cryptocurrency wallet recovery phrases using optical character recognition (OCR). It has been distributed through Apple's App Store, Google Play, and third-party Android app stores. The malware searches images on infected devices for sensitive credentials, allowing attackers to extract information without keystroke logging or clipboard monitoring. SparkKitty is an evolution of SparkCat, which also used OCR to harvest data. The malware spreads through trojanized applications posing as cryptocurrency services and messaging platforms. Once installed, these applications request access to the user's photo library to scan existing and new images. Text extracted from images, including wallet seed phrases and passwords, is sent to attacker-controlled servers. On iOS, SparkKitty was found in a cryptocurrency app called '币coin,' which passed Apple's review process by concealing malicious functionality. On Android, it was identified in an app named 'SOEX,' which had over 10,000 downloads before removal. Additional variants were distributed through third-party app stores and modified applications. Users storing wallet recovery phrases as screenshots or photos are at high risk, as possession of a seed phrase grants full access to a wallet. Recommendations include avoiding screenshots of recovery phrases, limiting photo library permissions, downloading apps from trusted sources, and storing recovery phrases offline.

Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.