Cybersecurity firm Kaspersky Labs has uncovered malware hidden in software development kits (SDKs) used to create apps for both Google\u2019s Play Store and Apple\u2019s App Store. This malware, named SparkCat, is designed to scan user photos for cryptocurrency wallet recovery phrases, enabling attackers to drain funds from victims’ wallets.<\/p>\n\n\n\n
In a report released on February 4, Kaspersky analysts Sergey Puzan and Dmitry Kalinin detailed how SparkCat operates. Once installed on a device, the malware employs an optical character recognition (OCR) tool to search images for recovery phrases in multiple languages. These phrases provide full access to crypto wallets, allowing hackers to steal funds without additional authentication.<\/p>\n\n\n\n
“The flexibility of the malware allows it to steal not only secret phrases but also other personal data from the gallery, such as the content of messages or passwords captured in screenshots,”<\/em> the analysts noted.<\/p>\n\n\n\n On Android devices, the malware disguises itself as an analytics module within apps, using a Java component called Spark. It connects to an encrypted configuration file hosted on GitLab, which delivers commands and updates. The malware leverages Google\u2019s ML Kit OCR to extract text from images, specifically looking for recovery phrases that can be used to access crypto wallets remotely.<\/p>\n\n\n\n SparkCat’s sophisticated design allows it to operate across platforms, affecting both Android and iOS users. The malware is difficult to detect due to its use of the Rust programming language, which is uncommon in mobile applications, and its heavy reliance on code obfuscation techniques.<\/p>\n\n\n\n Kaspersky estimates that SparkCat has been downloaded approximately 242,000 times since it first appeared in March. The malware primarily targets users in Europe and Asia and has been found in dozens of apps\u2014both legitimate and fake\u2014on Google\u2019s and Apple\u2019s app stores. Despite the range of apps, the malicious features remain consistent across platforms.<\/p>\n\n\n\n Kaspersky recommends several steps to protect against this malware:<\/p>\n\n\n\n “Users should be cautious about the apps they download, even from official app stores,”<\/em> Kaspersky warned.<\/p>\n\n\n\n As SparkCat continues to spread, users are advised to remain vigilant and take extra precautions when managing sensitive data on their devices.<\/p>\n","protected":false},"excerpt":{"rendered":" Cybersecurity firm Kaspersky Labs has uncovered malware hidden in software development kits (SDKs) used to create apps for both Google\u2019s Play Store and Apple\u2019s App Store. This malware, named SparkCat, is designed to scan user photos for cryptocurrency wallet recovery phrases, enabling attackers to drain funds from victims’ wallets. In a report released on February […]<\/p>\n","protected":false},"author":18,"featured_media":11190,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2,43],"tags":[],"class_list":{"0":"post-13538","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-featured","8":"category-general-news"},"acf":[],"yoast_head":"\nHow SparkCat Operates<\/h3>\n\n\n\n
Scope of the Infection<\/h3>\n\n\n\n
Protecting Against SparkCat<\/h3>\n\n\n\n
\n