Cybersecurity experts have discovered a new SparkKitty trojan that infects smartphones and steals data that can give hackers full access to users' cryptocurrency wallets. According to experts, the malware disguises itself as applications for cryptocurrency trading, gambling, and modified versions of popular apps such as TikTok. Once installed, SparkKitty requests permission to access the device’s gallery, monitors photo updates, and automatically uploads images to a remote server.
The main goal of the attackers is to find screenshots with seed phrases from crypto wallets, as this gives them full control over the user’s funds. SparkKitty operates on both Android and iOS, entering devices through official app stores and third-party sources. Although most of the attacks have been reported in China and Southeast Asia, experts warn that nothing prevents this trojan from spreading quickly to other countries.
According to experts, SparkKitty is related to the previously detected SparkCat spyware campaign, which used OCR technology to search for text (including seed phrases) on images in victims' smartphones. SparkKitty works even more simply: it transfers all photos to a server where they are analyzed later.
Experts advise to be especially careful with cryptocurrency apps, download them only from trusted sources, and do not store seed phrases as images on your phone. According to TRM Labs, last year almost 70% of all stolen cryptocurrencies were lost due to infrastructure attacks involving the theft of private keys and seed phrases.