A mobile malware campaign distributed through Apple’s App Store and Google Play accessed users’ photo libraries in search of cryptocurrency wallet recovery phrases and other sensitive data.
A new analysis from Check Point External Risk Management detailed SparkKitty’s spread through applications posing as crypto services, messaging platforms and entertainment products. The malware targeted Android and iOS devices through official stores, third-party marketplaces and sideloaded application packages.
Kaspersky first documented SparkKitty in June 2025, tracing the campaign back to at least February 2024. The latest report renewed attention around the malware’s ability to identify wallet credentials stored inside screenshots and photographs rather than waiting for users to type them into a phishing page.
On iOS, malicious code appeared inside a crypto-related application called 币coin. Android users encountered SparkKitty through SOEX, a messaging application that also advertised cryptocurrency exchange features.
SOEX passed Google Play’s review process and accumulated more than 10,000 downloads before Google removed it following a security notification. Apple also removed the affected iOS application.
Photo Permission Exposed Wallet Backups
The infected applications requested access to the device’s photo library while continuing to provide the functionality shown in their store listings.
Once permission was granted, SparkKitty collected existing images and monitored newly added files. Some versions uploaded gallery content directly, while related samples used optical character recognition to select images containing recovery phrases, passwords, QR codes and other text.
The stolen files were sent to attacker-controlled command-and-control servers alongside device information. A complete seed phrase allows an attacker to restore a compatible wallet on another device and move its assets without access to the original phone or wallet password.
Users who installed an affected application and stored recovery words in their gallery should treat the wallet as compromised. Deleting the photograph or uninstalling the application does not revoke access once the phrase has been copied. Remaining assets need to be moved to a new wallet generated from a fresh seed phrase on a clean device.
Malware Campaigns Shift Toward Wallet Secrets
SparkKitty follows a series of attacks built around collecting the recovery material controlling crypto wallets.
A compromised Injective npm package captured mnemonics and private keys when developers created or loaded wallets through the poisoned software development kit. The malicious release reached 18 packages before being removed and replaced.
Microsoft also traced CryptoBandits malware spreading through infected USB drives, combining seed-phrase collection and screenshot theft with clipboard monitoring and crypto-address replacement.
Check Point did not disclose a confirmed number of compromised wallets or the value of any cryptocurrency stolen through SparkKitty. The identified applications are no longer available through Apple’s App Store or Google Play.
