CYBERSECURITYApril 3, 20261 min read13 views

New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images

Cybersecurity researchers have identified a new version of the SparkCat malware on official app stores that uses OCR technology to steal cryptocurrency wallet recovery phrases from users' photo galleries.

Cybersecurity researchers have discovered a new version of the SparkCat malware on the Apple App Store and Google Play Store, more than a year after the trojan was discovered targeting both the mobile operating systems.

The malware has been found to conceal itself within seemingly benign apps, such as enterprise messengers and food delivery services, while silently scanning victims' photo galleries for cryptocurrency wallet recovery phrases.

Russian cybersecurity company Kaspersky said it found two infected apps on the App Store and one on the Google Play Store that primarily target cryptocurrency users in Asia.

"The iOS variant, however, takes a different approach as it scans for cryptocurrency wallet mnemonic phrases, which are in English," the company said. "This makes the iOS variant potentially broader in reach, as it can affect users regardless of their region."

The improved version of SparkCat for Android incorporates several obfuscation layers compared to previous iterations. This includes the use of code virtualization and cross-platform programming languages to sidestep analysis efforts. What's more, the Android version scans for Japanese, Korean, and Chinese keywords, indicating an Asian focus.

SparkCat was first documented by Kaspersky in February 2025, highlighting its ability to leverage an optical character recognition (OCR) model to exfiltrate select images containing wallet recovery phrases from photo libraries to an attacker-controlled server.

The latest improvements to the malware show that it's an actively evolving threat, not to mention the technical capabilities of the threat actors behind the operation. Kaspersky had previously assessed the malicious activity to be the work of a Chinese-speaking operator.

"The updated variant of SparkCat requests access to view photos in a user's smartphone gallery in certain scenarios — just like the very first version of the Trojan," Kaspersky researcher Sergey Puzan told The Hacker News. "It analyzes the text in stored images using an optical character recognition module."

"If the stealer finds relevant keywords, it sends the image to the attackers. Considering the similarities of the current sample and the previous one, we believe that the developers of the new version of malware are the same. This campaign again underscores the importance of using security solutions for smartphones to stay protected against a broad range of cyberthreats."

Source: The Hacker News

More in this category

cybersecurity

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a massive campaign named FakeGit, leveraging thousands of malicious GitHub repositories to distribute SmartLoader malware. The campaign features a novel technique called AgentBaiting, which tricks AI agents into executing malicious instructions autonomously.

cybersecurity

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A mere 11-byte TLS request can force an unpatched OpenSSL server to allocate up to 131 KB of memory that is never released. OpenSSL silently patched this "HollowByte" vulnerability without issuing a CVE or security advisory.

cybersecurity

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.

cybersecurity

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to CylindricalCanine, a subgroup of the Chinese cybercrime group GoldenEyeDog, which compromised DigiCert's support portal to steal and abuse code-signing certificates.

cybersecurity

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Armenia has detained a Russian tourist on a U.S. extradition warrant targeting a REvil ransomware suspect. However, defense lawyers argue it is a case of mistaken identity caused by incomplete name details in the U.S. warrant.

cybersecurity

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an active infostealer, is targeting enterprise networks using sophisticated 'ClickFix' social engineering lures. By tricking users into pasting malicious commands into the Run dialog, attackers can easily steal session tokens, browser credentials, and sensitive documents from OneDrive and SharePoint.