SparkKitty Malware Steals Crypto Wallet Seed Phrases From iOS and Android Photos

A new mobile threat is quietly targeting cryptocurrency users by reading the photos stored on their phones.

Known as SparkKitty, this malware works on both iOS and Android devices and focuses on stealing wallet seed phrases hidden inside screenshots and gallery images.

Instead of logging keystrokes or watching the clipboard, it uses optical character recognition to pull text straight from pictures.

The campaign has already reached official app marketplaces, which means everyday users who trust those stores remain at risk.

Once installed, the malware asks for photo access, scans images for sensitive strings, and sends the results to remote servers controlled by the attackers.

Analysts or researchers from Check Point identified the malware and mapped how it spreads through trojanized apps that look like normal crypto tools, messaging platforms, and entertainment software.

Check Point said in a report shared with Cyber Security News (CSN) that SparkKitty is a direct evolution of an earlier stealer called SparkCat.

Related coverage of earlier malicious apps targeting mobile users shows how similar OCR-based theft has grown over time.

The impact is serious because a single leaked seed phrase can give criminals full control of a crypto wallet and empty it within minutes.

Victims may never notice anything wrong until funds disappear. The malware runs quietly in the background after users grant gallery permission, and it also collects device details that help attackers refine later campaigns.

Widespread availability through popular stores and third-party sideloading channels has expanded the pool of potential targets far beyond niche communities.

SparkKitty Malware Steals Crypto Wallet Seed Phrases

SparkKitty stands out because it treats the photo gallery as a treasure chest of financial secrets. Many people photograph or screenshot their recovery phrases for convenience, and the malware is built to find exactly those images.

After permission is granted, it watches the image folder and periodically runs OCR libraries against new and existing files.

On iOS the payload hid inside a cryptocurrency-themed app called “币coin” that appeared on the App Store. Obfuscated frameworks helped it slip past initial review.

On Android an app named “SOEX” posed as a messaging and exchange platform, gained more than 10,000 downloads on Google Play, and was later removed.

Variants also spread through third-party stores, modded TikTok clones, and gambling apps, echoing patterns seen when researchers examined malicious Android apps found on official marketplaces.

Extracted text, including seed phrases, passwords, and QR code data, travels silently to command-and-control infrastructure along with basic device metadata.

Users who keep recovery information in plain screenshots face the highest risk. The same approach can capture other secrets stored as images, turning a simple photo backup habit into a costly mistake for anyone holding digital assets.

How SparkKitty Reaches Mobile Devices

Delivery relies on two main paths: official store listings and sideloaded packages. Store versions raise trust and reach large audiences quickly, while sideloaded APKs and rooted-device modules extend persistence on Android through frameworks such as Xposed.

Both routes request gallery access soon after install so scanning can begin without further user interaction.

Security teams tracking Google Play malicious apps removal efforts note that even brief store presence can produce thousands of infections.

Once active, SparkKitty continues monitoring for new images, so later screenshots of wallets remain exposed. People who manage online crypto payment risks should treat any unexpected photo permission request as a warning sign.

Practical steps reduce exposure. Avoid installing crypto or messaging apps from unknown sources, deny gallery access unless it is essential, and never store seed phrases as photos or screenshots.

Prefer hardware wallets or offline paper backups kept in secure physical locations. Keep devices updated, review app permissions regularly, and remove any application that suddenly asks for broad media access.

If infection is suspected, disconnect from networks, move remaining funds from a clean device, and rotate related credentials promptly.

These habits close the main gaps SparkKitty exploits and help users stay ahead of similar photo-scanning stealers that may appear.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.