SparkKitty Malware Steals Crypto Seed Phrases from Photos on App Stores

A new strain of malware called SparkKitty has infiltrated both the App Store and Google Play, targeting crypto users' seed phrases through their photo galleries. According to Kaspersky researchers, the Trojan uses Optical Character Recognition (OCR) technology to scan images for patterns matching seed phrase formats.

The malware was embedded in apps such as 币coin, a crypto-rate tracking application on the App Store, and SOEX, a messaging app with crypto-exchange functionality on Google Play. These apps had accumulated over 10,000 installs before being pulled by Apple and Google following Kaspersky's disclosure.

The primary targets of SparkKitty were users in China and Southeast Asia. The malware has been active since at least February 2024, suggesting it operated undetected for over a year before being publicly identified.