Kaspersky Warns Users Of “SparkCat” Malware That Targets The Crypto Wallet Of Android and IOS Users

Kaspersky researchers have identified a cross-platform malware campaign, “SparkCat,” that targets cryptocurrency wallet recovery phrases by embedding a malicious software development kit (SDK) within modified mobile apps.

According to the report, the malware scans users’ image galleries for sensitive data, a technique first detected in March 2023.

Initially, cybersecurity experts found malware-laced messaging apps that extracted crypto wallet mnemonics and transmitted them to remote servers. At the time, the attack was limited to Android and Windows users downloading apps from unofficial sources.

However, the SparkCat campaign, discovered in late 2024, has expanded its reach. The new version integrates the malicious SDK into apps available on both official and unofficial marketplaces for Android and iOS devices.

Once active, SparkCat uses Google ML Kit's OCR tool to scan the device's image gallery, and searches for specific keywords related to crypto wallet recovery phrases across multiple languages, including English, Chinese Korean, Japanese, and several European languages.

The malware then uploads the image to an attacker-controlled server, either via Amazon cloud storage or a Rust-based protocol, which adds an extra layer of complexity in tracking its activity due to encrypted data transfers and non-standard communication methods.

On IOS, SparkCat operates through a malicious framework embedded in the infected app, which allows the virus to disguise itself under names like GZIP, Googleappsdk, or stat.

This framework, written in Objective-C and obfuscated with HikariLLV, integrates with Google ML Kit to extract text from images in the gallery.

Apparently, the malware is also able to steal other sensitive data like content of messages or passwords that could remain on screenshots.

Kaspersky estimates that more than 242,000 devices across Asia and Europe has already been infected by the malware already. While the exact source of the malware remains unknown, embedded comments in the code and error messages suggest that the malware developers come from a Chinese speaking country.

Researchers at Kaspersky urge users to avoid storing important information like sewed phrases, private keys adn passwords within screenshots.

Sophisticated malware remains a consistent threat within the crypto space, and this is not the first time bad actors have managed to bypass Google and Apple's store security measures.