SparkKitty Malware Steals Crypto Wallet Recovery Phrases From Mobile Photos

A malicious mobile app called SparkKitty has been stealing cryptocurrency wallet recovery phrases from users' photo libraries on iPhones and Android devices. The malware, which is a direct evolution of the SparkCat stealer, was discovered by Kaspersky in early 2024 and detailed publicly in June 2025.

SparkKitty reached Apple's App Store and Google Play, where it masqueraded as a legitimate app called 币coin on iOS and SOEX on Android. The malware requested access to users' photo libraries and used optical character recognition to scan stored images for wallet recovery phrases.

The attackers may have been after confidential data such as recovery phrases, passwords, and QR codes. Check Point credits Kaspersky with discovering SparkKitty and notes that it is unclear whether the developer account was compromised or complicit in spreading the malware.