A new mobile malware called SparkKitty is silently invading smartphones, searching image libraries for cryptocurrency seed phrases to steal funds.
Cybersecurity firm Kaspersky uncovered the threat after months of monitoring suspicious activity across both Android and iOS platforms.
The malware is hidden inside seemingly harmless apps and has already affected thousands of users, mostly in China and Southeast Asia.
SparkKitty is embedded in various crypto-themed apps, such as portfolio trackers and messaging tools, as well as adult games, casino platforms, and counterfeit TikTok clones.
One compromised app, SOEX, was a messaging platform with crypto exchange features and had already been downloaded over 10,000 times before Google removed it.
Another, known as 币coin, posed as a crypto price tracker and was hosted on Apple’s App Store.
Once installed, the apps behave like regular tools while quietly requesting permission to access photo galleries.
After access is granted, the malware begins scanning for potential wallet recovery phrases hidden in screenshots or handwritten notes.
On Android devices, the malware uses modified Java libraries along with Google’s ML Kit to identify seed phrases via optical character recognition (OCR).
On iOS, attackers embedded a hidden class into networking frameworks like AFNetworking or Alamofire.
This class activates automatically at launch using Objective-C’s +load method, checks a configuration setting, then connects to a command-and-control (C2) server to receive instructions.
The stolen images are sent to external servers via encrypted communications, with malware variants using spoofed OpenSSL libraries and obfuscated paths like `/api/putImages` and `/api/getImageStatus`.
The iOS version bypasses normal restrictions by abusing Apple’s enterprise provisioning system.
Victims are tricked into manually trusting a developer certificate linked to “SINOPEC SABIC Tianjin Petrochemical Co. Ltd.”
Once installed, the malware operates with near-system-level access, enabling it to scan photos without alerting the user.
Kaspersky’s researchers noted this tactic makes it harder to detect compared to more conventional threats.
Kaspersky analysts Sergey Puzan and Dmitry Kalinin wrote,
“Although we suspect the attackers’ main goal is to find screenshots of crypto wallet seed phrases, other sensitive data could also be present in the stolen images.”
SparkKitty appears to be an evolved version of SparkCat, a malware first flagged in January 2025 that also targeted photo galleries to extract seed phrases.
Both strains share similarities in code, debug symbols, and infection techniques.
Translated image of SparkCat process (Source: X)
However, SparkKitty shows broader ambitions by indiscriminately uploading entire photo libraries rather than scanning locally.
While SparkCat mainly operated through unofficial Android downloads, SparkKitty has managed to breach official app stores, significantly raising the risk of exposure to regular users.
The malware campaign highlights the ongoing danger to crypto holders.
Seed phrases — the recovery keys to cryptocurrency wallets — remain highly sought after by cybercriminals due to their direct link to user funds.
According to TRM Labs’ 2024 report, over 70% of the $2.2 billion in crypto thefts last year stemmed from private key and seed phrase compromises. SparkKitty fits directly into this pattern.
Despite the removal of several infected apps, Kaspersky warns that SparkKitty’s campaign may still be active via sideloaded versions and clone stores, with no region-specific limitations.
Puzan and Kalinin said,
"While not technically or conceptually complex, this campaign has been ongoing since at least the beginning of 2024 and poses a significant threat to users."
The US DOJ has filed an antitrust lawsuit against Visa, accusing it of maintaining a debit payments monopoly. The DOJ claims Visa uses exclusivity agreements and penalties to stifle competition, forcing businesses to use its network while blocking new competitors from entering the market.
CatherineEasyA has partnered with the Web3 Foundation to launch the EasyA x Polkadot University, funded by a grant to provide workshops, hackathons, and grants aimed at fostering innovation within the Polkadot ecosystem. This initiative responds to the rising demand for Web3 professionals and seeks to educate the next generation of blockchain developers.
AnaisArchaeologists have discovered 303 new geoglyphs in the Nazca Lines of Peru using artificial intelligence, significantly enhancing the understanding of these ancient markings. This breakthrough highlights the potential of technology in archaeology, revealing new insights into the Nazca civilization and its mysterious creations.
AnaisAhead of the 26 September HMSTR token launch, Hamster Kombat announced plans for NFTs, new games, and less reliance on Telegram. By 2025, it aims to launch an NFT marketplace, host a clan championship, and start the second phase of its airdrop.
CatherinePayments giant PayPal now allows US merchants, except New York, to buy, hold, and sell crypto via their business accounts. This move expands PayPal's crypto accessibility, offering enhanced financial tools to millions of businesses.
KikyoSouth Korea is launching the Digital Asset User Protection Foundation to help users recover funds trapped in failed cryptocurrency exchanges, which have seen ten out of 22 platforms shut down. The foundation, expected to start operations in October, will coordinate with defunct exchanges to securely manage and return users' assets.
AnaisOpenAI is transitioning to a for-profit benefit corporation. Reports suggest that Sam Altman could receive a 7% equity stake, potentially valued at $10.5 billion. This prompts an important question: why are so many key insiders departing?
CatherineA Singapore court granted WazirX a four-month conditional moratorium after its July hack, which led to a $234 million loss. The exchange initially requested six months but received a shorter relief period under specific conditions to address its financial situation.
KikyoMeta is revamping its metaverse avatars with a major update launching on October 1st, allowing users to customize features like eye size and body types. Future updates will include AI-generated avatars and new options for fantasy characters, enhancing user experience in the metaverse.
JoyA scam targeting cryptocurrency investors in Hong Kong has led to losses of HK$14.8 million, with victims tricked into making transactions at fake exchange shops. One businessman lost HK$4 million after realizing he was locked inside a shop while scammers escaped with his money.
Weatherly