SparkKitty Malware Scans Photos for Crypto Wallet Seed Phrases
A new malware campaign has been discovered targeting cryptocurrency users by scanning photos stored on infected devices for wallet recovery phrases and other sensitive information.
The SparkKitty malware, first detected in June 2025 by Kaspersky, spread through Apple's App Store, Google Play, and third-party app stores. It was distributed as a trojanized application disguised as a legitimate cryptocurrency tool or messaging platform.
On iOS, the malware appeared in a cryptocurrency app called '币coin' on the App Store, while on Android, it was found in a messaging and cryptocurrency exchange app called SOEX on Google Play. The app had been downloaded over 10,000 times before being removed.
Researchers recommend keeping wallet recovery phrases offline instead of storing them as screenshots, limiting photo library permissions to trusted apps, and downloading software only from reputable developers.