Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnWeb3SquareMore
Trade
Spot
Buy and sell crypto with ease
Margin
Amplify your capital and maximize fund efficiency
Onchain
Going Onchain, without going Onchain!
Convert
Zero fees, no slippage
Explore
Launchhub
Gain the edge early and start winning
Copy
Copy elite trader with one click
Bots
Simple, fast, and reliable AI trading bot
Trade
USDT-M Futures
Futures settled in USDT
USDC-M Futures
Futures settled in USDC
Coin-M Futures
Futures settled in cryptocurrencies
Explore
Futures guide
A beginner-to-advanced journey in futures trading
Futures promotions
Generous rewards await
Overview
A variety of products to grow your assets
Simple Earn
Deposit and withdraw anytime to earn flexible returns with zero risk
On-chain Earn
Earn profits daily without risking principal
Structured Earn
Robust financial innovation to navigate market swings
VIP and Wealth Management
Premium services for smart wealth management
Loans
Flexible borrowing with high fund security
SparkKitty malware steals crypto seed phrase screenshots

SparkKitty malware steals crypto seed phrase screenshots

GrafaGrafa2025/06/24 20:30
By:Heidi Cuthbert

Cybersecurity firm Kaspersky has identified SparkKitty, a malware targeting iOS and Android devices by stealing photos to capture cryptocurrency wallet seed phrases.

According to Kaspersky analysts Sergey Puzan and Dmitry Kalinin, SparkKitty infiltrates apps on the Apple App Store and Google Play, indiscriminately extracting all images from infected devices’ galleries.

The malware’s primary goal appears to be locating screenshots containing crypto wallet recovery phrases, though other sensitive images may also be compromised.

Two malicious apps distributing SparkKitty were found: 币coin, a crypto information tracker on the App Store, and SOEX, a messaging app with crypto exchange features on Google Play.

SOEX was installed over 10,000 times before Google removed it and banned its developer.

A Google spokesperson confirmed that Android users are protected by Google Play Protect against this app regardless of download source.

Kaspersky also discovered SparkKitty delivered via casino apps, adult-themed games, and fake TikTok clones.

SparkKitty is closely related to SparkCat, a malware identified in January that similarly scans photos for crypto wallet recovery phrases.

Both share features and file paths, suggesting a common origin.

“While not technically or conceptually complex, this campaign has been ongoing since at least the beginning of 2024 and poses a significant threat to users,” Puzan and Kalinin noted.

Unlike SparkCat, SparkKitty steals all photos rather than selectively targeting images.

The campaign mainly targets users in Southeast Asia and China, based on infected apps including Chinese gambling games and adult content.

“Judging by the distribution sources, this spyware primarily targets users in Southeast Asia and China,” the analysts said.

However, they added the malware has no technical restrictions preventing attacks on users in other regions.

Users are advised to exercise caution when downloading apps and to rely on security features like Google Play Protect to reduce infection risk.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Locked for new tokens.
APR up to 10%. Always on, always get airdrop.
Lock now!