A sophisticated new mobile malware called SparkKitty has successfully infiltrated both Google Play and Apple App Store, specifically targeting cryptocurrency wallet recovery phrases stored on Android and iOS devices.
## Evolution of Crypto-Stealing Malware
SparkKitty appears to be an advanced version of SparkCat, previously discovered by Kaspersky in January 2024. While SparkCat used optical character recognition (OCR) to extract cryptocurrency wallet recovery phrases from saved images, SparkKitty takes a more aggressive approach by stealing all images from infected devices’ photo galleries.
These recovery phrases, also known as seed phrases, are critical security keys that allow users to restore their cryptocurrency wallets and access stored digital assets. Although security experts strongly advise against storing these phrases digitally, many users still screenshot them for convenience, making them prime targets for cybercriminals.
## Campaign Details and Distribution
The SparkKitty campaign has been active since February 2024, spreading through both official and unofficial app distribution channels. Kaspersky identified two primary malicious applications:
– **币coin** on Apple App Store
– **SOEX** on Google Play (downloaded over 10,000 times)
Both apps have since been removed from their respective stores. SOEX masqueraded as a messaging app with cryptocurrency exchange features, while researchers also discovered the malware embedded in modified TikTok clones, gambling apps, and adult-themed games distributed through unofficial channels.
## Technical Implementation
### iOS Deployment
On iOS devices, SparkKitty embeds itself as fake frameworks (AFNetworking.framework, libswiftDarwin.dylib) and sometimes uses enterprise provisioning profiles for distribution. The malware automatically executes when the app launches and requests photo gallery access to monitor for new images.
### Android Implementation
On Android, the malware integrates into Java/Kotlin applications, sometimes utilizing malicious Xposed/LSPosed modules. It activates during app launch or specific user actions and requests storage permissions to access device images.
## Data Exfiltration Process
Once activated, SparkKitty retrieves encrypted configuration files using AES-256 encryption to establish command-and-control server connections. The malware then systematically uploads images along with device identifiers and metadata. Some variants use Google ML Kit OCR to specifically target images containing text, likely focusing on cryptocurrency recovery phrases.
## Security Implications
Beyond cryptocurrency theft, the stolen images could be used for various malicious purposes, including extortion if they contain sensitive personal content. This broad data collection approach makes SparkKitty particularly dangerous for all mobile users, not just cryptocurrency holders.
## Protection Recommendations
### For All Users:
– Scrutinize apps before installation, checking for fake reviews and suspicious publisher backgrounds
– Deny unnecessary storage or gallery permissions during app installation
– Avoid installing configuration profiles from untrusted sources on iOS
– Enable Google Play Protect on Android devices
### For Cryptocurrency Users:
– Never store wallet recovery phrases digitally on mobile devices
– Keep seed phrases offline in secure, physical locations
– Regularly audit installed applications for suspicious behavior
## Industry Response
Google confirmed the removal of the reported malicious app and banned the associated developer. The company stated that Android users are automatically protected by Google Play Protect, which is enabled by default on devices with Google Play Services. Apple has not yet responded to requests for comment regarding their app store security measures.
This incident underscores the ongoing challenge of malware infiltrating official app stores and highlights the critical importance of user vigilance, even when downloading from trusted platforms.