SparkKitty Malware: Crypto Seed Phrase Thief
SparkKitty malware steals seed phrase screenshots via crypto apps on iOS/Android—learn how it works and ways to protect your wallet.
- SparkKitty steals gallery images, seeking crypto seed‑phrase screenshots.
- Distributed via disguised crypto apps on App Store & Google Play.
- Users in Southeast Asia/China targeted; global expansion possible.
Discovered by Kaspersky in June 2025, SparkKitty is a photo-stealing malware that targets iOS and Android users. It spreads through crypto-themed apps that seem legitimate but are designed to access the user’s photo gallery. Once installed, SparkKitty scans images—especially screenshots of wallet seed phrases—and sends them to a remote server controlled by attackers.
Unlike earlier malware like SparkCat, which uses OCR to analyze images before stealing, SparkKitty grabs all photos indiscriminately, likely aiming to exploit the common practice of saving seed phrases as screenshots.
How It Spreads
Infected Apps
On iOS, an app named “币 coin” passed Apple’s review process and appeared in the App Store. On Android, the malware was embedded in an app called SOEX, disguised as a messaging app with crypto exchange features. SOEX was downloaded over 10,000 times before removal.
Phishing Websites
Cybercriminals also distribute SparkKitty via third-party sites, offering fake TikTok mods and entertainment apps. iOS users are tricked into installing developer profiles to bypass App Store protections.
Who’s Affected and What to Do
Target Regions
Most victims so far are in Southeast Asia and China, but SparkKitty’s code doesn’t limit its reach—meaning anyone worldwide could be at risk.
Protection Tips
- Avoid apps that request photo access without reason.
- Never store seed phrases as screenshots.
- Delete any crypto-related screenshots immediately.
- Stick to apps from verified developers.
- On iOS, remove unknown device profiles via Settings → General → Device Management.
- Consider using a trusted antivirus tool to detect malicious activity.
Why It Matters
Seed phrases give full access to crypto wallets. With SparkKitty harvesting them from galleries, crypto investors are facing a real and growing risk. The malware’s infiltration of official app stores underlines the need for constant vigilance—even with apps that seem safe.
Read Also :
- Ethereum Exchange Inflows Surge Amid Market Calm
- Justin Sun Sues Bloomberg as ETH Eyes $6K Breakout
- Ethereum Stalls Again at $4.7K Resistance Zone
- Cathie Wood Predicts Bitcoin Could Surge 15x by 2030
- CMBI Launches 24/7 Crypto Trading in Hong Kong
