Fake Crypto, Casino, and TikTok Clone Apps on Google Play and App Store Spread SparkKitty Malware That Steals Seed Phrase Screenshots

SparkKitty Malware Secretly Targets Crypto Users Through Photo Galleries

A new mobile malware called SparkKitty is silently invading smartphones, searching image libraries for cryptocurrency seed phrases to steal funds.

Cybersecurity firm Kaspersky uncovered the threat after months of monitoring suspicious activity across both Android and iOS platforms.

The malware is hidden inside seemingly harmless apps and has already affected thousands of users, mostly in China and Southeast Asia.

How Malicious Apps Trick Users Into Granting Access

SparkKitty is embedded in various crypto-themed apps, such as portfolio trackers and messaging tools, as well as adult games, casino platforms, and counterfeit TikTok clones.

One compromised app, SOEX, was a messaging platform with crypto exchange features and had already been downloaded over 10,000 times before Google removed it.

Another, known as 币coin, posed as a crypto price tracker and was hosted on Apple’s App Store.

Once installed, the apps behave like regular tools while quietly requesting permission to access photo galleries.

After access is granted, the malware begins scanning for potential wallet recovery phrases hidden in screenshots or handwritten notes.

SparkKitty’s Sophisticated Extraction Tactics

On Android devices, the malware uses modified Java libraries along with Google’s ML Kit to identify seed phrases via optical character recognition (OCR).

On iOS, attackers embedded a hidden class into networking frameworks like AFNetworking or Alamofire.

This class activates automatically at launch using Objective-C’s +load method, checks a configuration setting, then connects to a command-and-control (C2) server to receive instructions.

The stolen images are sent to external servers via encrypted communications, with malware variants using spoofed OpenSSL libraries and obfuscated paths like `/api/putImages` and `/api/getImageStatus`.

Trick Installation Through Enterprise Profiles

The iOS version bypasses normal restrictions by abusing Apple’s enterprise provisioning system.

Victims are tricked into manually trusting a developer certificate linked to “SINOPEC SABIC Tianjin Petrochemical Co. Ltd.”

Once installed, the malware operates with near-system-level access, enabling it to scan photos without alerting the user.

Kaspersky’s researchers noted this tactic makes it harder to detect compared to more conventional threats.

Kaspersky analysts Sergey Puzan and Dmitry Kalinin wrote,

“Although we suspect the attackers’ main goal is to find screenshots of crypto wallet seed phrases, other sensitive data could also be present in the stolen images.”

Link To Previous SparkCat Campaign

SparkKitty appears to be an evolved version of SparkCat, a malware first flagged in January 2025 that also targeted photo galleries to extract seed phrases.

Both strains share similarities in code, debug symbols, and infection techniques.

Translated image of SparkCat process (Source: X)

However, SparkKitty shows broader ambitions by indiscriminately uploading entire photo libraries rather than scanning locally.

While SparkCat mainly operated through unofficial Android downloads, SparkKitty has managed to breach official app stores, significantly raising the risk of exposure to regular users.

Crypto Remains Prime Target

The malware campaign highlights the ongoing danger to crypto holders.

Seed phrases — the recovery keys to cryptocurrency wallets — remain highly sought after by cybercriminals due to their direct link to user funds.

According to TRM Labs’ 2024 report, over 70% of the $2.2 billion in crypto thefts last year stemmed from private key and seed phrase compromises. SparkKitty fits directly into this pattern.

Despite the removal of several infected apps, Kaspersky warns that SparkKitty’s campaign may still be active via sideloaded versions and clone stores, with no region-specific limitations.

Puzan and Kalinin said,

"While not technically or conceptually complex, this campaign has been ongoing since at least the beginning of 2024 and poses a significant threat to users."