SparkKitty: New Threat to Crypto Users
A novel malware, SparkKitty, is posing a significant risk to cryptocurrency users by exploiting photos stored on mobile devices. This malware, affecting both iOS and Android platforms, specifically targets wallet seed phrases concealed within screenshots and image galleries. Instead of traditional methods like keystroke logging, SparkKitty employs optical character recognition (OCR) to extract text from images.
Infiltration through App Marketplaces
SparkKitty has infiltrated official app marketplaces, putting unsuspecting users at risk. Once installed, the malware requests access to photos and scans for sensitive information, sending it to servers under attacker control. Check Point researchers have traced this malware’s spread through apps disguised as legitimate cryptocurrency, messaging, and entertainment tools.
Evolution from Previous Threats
This malware is an evolution of SparkCat, an earlier threat. Similar OCR-based attacks have grown more common, highlighting the danger posed by leaked seed phrases, which can allow criminals to empty crypto wallets swiftly. Victims often remain unaware until their funds are missing, as the malware operates silently after gaining gallery access.
How SparkKitty Exploits Photos
Targeting the Photo Gallery
SparkKitty treats photo galleries as repositories of financial secrets. Many users store recovery phrases for convenience, making them easy targets. After obtaining permission, the malware continuously monitors the gallery, utilizing OCR to scan both new and existing images.
App Disguises and Distribution
On iOS, SparkKitty was hidden within an app called “币coin” on the App Store, while on Android, an app named “SOEX” masqueraded as a messaging platform, achieving over 10,000 downloads before removal. Variants have also been found in third-party stores and modded applications.
Preventive Measures and Security Tips
Minimizing Risk Exposure
To protect against SparkKitty, users should avoid installing apps from untrusted sources and deny gallery access unless necessary. Storing seed phrases as photos is particularly risky. Instead, consider hardware wallets or offline backups in secure locations.
Maintaining Vigilant Security Practices
Regularly updating devices, reviewing app permissions, and promptly removing apps that request excessive access are crucial steps. In case of suspected infection, disconnect from networks, transfer funds using a clean device, and update related credentials.
Conclusion
SparkKitty highlights the vulnerabilities in photo storage habits, urging crypto users to adopt safer practices. By staying informed and cautious, users can guard their digital assets against this and similar threats.
