SparkKitty malware has infiltrated Apple and Google’s app stores, and is specifically designed to steal cryptocurrency wallet mnemonic phrases.

According to Check Point, cross-platform malware named SparkKitty has spread through Apple App Store, Google Play, and third-party Android app stores. The malware uses OCR (Optical Character Recognition) technology to scan images in users’ photo albums, targeting sensitive data including cryptocurrency wallet mnemonics, passwords, and QR codes. The report notes that SparkKitty is an upgraded iteration of the earlier information-stealing program SparkCat, disguised as apps such as crypto services, communication tools, and entertainment platforms for distribution. Once installed, the app requests photo album access permission, continuously scans existing and new images, and uploads the extracted text plus device information to the attacker’s server. On iOS, the malicious code was embedded in a crypto application titled “Coin” (Chinese: 币), evading Apple’s app review via code obfuscation. On Android, researchers identified the malware in “SOEX”, a chat and crypto trading app; it was pulled from Google Play only after amassing over 10,000 total downloads. Attackers also spread SparkKitty through additional channels: third-party app stores, sideloaded APKs, modified versions of TikTok, and entertainment apps. Check Point warns that if users save wallet mnemonics as screenshots or photos, their corresponding crypto wallets can be fully controlled by attackers once the mnemonics are stolen. The security agency advises against storing mnemonics in mobile photo albums—instead, they should be kept offline, such as via paper backups or hardware wallet backups. It also recommends users exercise caution when granting photo album permissions to apps and only download applications from trusted sources.