SparkKitty Malware in Apple, Google Apps Targets Crypto Seed Phrases: How to Stay Safe
Key Takeaways
- SparkKitty malware on Apple and Google apps scans photos to steal crypto wallet seed phrases.
- One infected Android app topped 10,000 downloads before Google removed it.
- Avoid storing seed phrases in screenshots and restrict photo access to apps.
A cross-platform information stealer that reads screenshots to harvest cryptocurrency wallet recovery phrases has resurfaced in fresh threat intelligence, with Check Point’s Cyberint research team publishing updated indicators of compromise on July 26 alongside malware samples first cataloged in April 2026.
The strain, named SparkKitty, reached victims through applications distributed on both the Apple App Store and Google Play, giving it an attack surface most mobile malware never obtains.
https://.twitter/The_Cyber_News/status/2081948560594227501
Why Screenshots Are the Attack Vector
SparkKitty abandons the techniques most crypto-stealing malware relies on. Rather than logging keystrokes or hijacking the clipboard when a wallet address is copied, it requests permission to access the device’s photo gallery, then applies optical character recognition to every image stored there.
The malware scans for readable text inside pictures, targeting screenshots that contain seed phrases, private keys, passwords, or QR codes, and transmits any extracted strings to a remote command-and-control server along with device metadata.
The design exploits a widespread user habit. Wallet setup screens instruct holders to record their 12- or 24-word recovery phrase, and a substantial share of users photograph or screenshot that screen rather than writing it down.
Once the phrase sits in the camera roll, no amount of exchange security, two-factor authentication, or hardware wallet discipline protects the funds, because anyone holding the seed phrase controls the wallet outright. Researchers identify SparkKitty as a direct descendant of SparkCat, an earlier stealer discovered by Kaspersky in early 2024 and publicly documented in June 2025.
How SparkKitty Got Past Apple and Google
On iOS, the payload is delivered via a cryptocurrency application named 币coin. Its operators concealed malicious functionality within obfuscated frameworks carrying legitimate-looking names, including a modified AFNetworking library and a file called libswiftDarwin.dylib, which allowed the app to clear Apple’s review process. Researchers have not established whether the developer account was compromised or whether the developer was knowingly involved.
The Android distribution ran through an app called SOEX, marketed as a combined messaging and crypto exchange platform, which surpassed 10,000 downloads on Google Play before it was removed. Additional variants circulated outside official stores through sideloaded APK files, modified TikTok clones, and gambling applications. On rooted Android devices, the malware used Xposed framework modules to maintain persistence across reboots.
How To Keep Your Crypto Wallets Safe
The defensive measures are behavioral rather than technical, because no antivirus product reliably catches OCR-based extraction once gallery permission has been granted.
- Never photograph or screenshot a seed phrase. Write it on paper or stamp it into metal, and store it physically.
- Audit your existing camera roll now. If any wallet setup screen, exchange backup code, or private key appears in your photos, treat that wallet as compromised and migrate funds to a new one with a freshly generated phrase.
- Revoke photo library access for any application that does not require it. On both iOS and Android, granting “selected photos only” rather than full library access limits exposure.
- Treat crypto apps outside official stores as hostile by default, and verify the developer’s identity before installing, even from official stores.
- Avoid rooted or jailbroken devices for anything holding crypto, since they enable the persistence techniques SparkKitty uses.
The broader pattern matters more than this specific strain. Attackers have moved from stealing credentials to stealing the recovery mechanisms behind them, because seed phrases require no session, no password reset, and no interaction with the victim.
As long as wallet software presents recovery phrases on screens that users can capture, OCR-driven stealers will keep appearing under new names. The next variant will likely arrive through the same channel: an application that appears legitimate, requests a reasonable permission, and reads what it finds.
