- SparkCat info stealer hidden in iOS App Store and Play Store
- Target Crypto Starter Phrases Using OCR and Keywords
- New obfuscation techniques make detection more difficult
SparkCat, a mobile information stealer that targets people’s cryptocurrencies, is back with new updates that make it harder to detect.
Kaspersky cybersecurity researchers claim to have found multiple apps in both the Apple App Store and Google Play Store that deliver the malware.
Apple and Google app repositories are generally safe, and knowing the size and popularity of the platforms, both companies go the extra mile to make sure the apps offered there are clean. However, from time to time, threat actors manage to work around the perimeter to smuggle in malicious applications.
Article continues below.
Searching for mnemonics
In this case, Kaspersky said it discovered enterprise messaging apps and food delivery services hiding SparkCat.
This information thief was first detected in 2025, searching for people’s mnemonic seeds or “seed phrases” – a set of 12 or 24 seemingly random words that can be used to load a person’s cryptocurrency wallet onto another device as a backup solution in case the device is lost or broken.
SparkCat recently made headlines for the way it used OCR (optical character recognition) to extract seed phrases from photos and screenshots. It primarily targeted Asian users, and while the new version continues to do the same, it has gone a step further to potentially target Western users as well.
The Android version still searches for Japanese, Korean, and Chinese keywords. The iOS version, however, looks for mnemonics in English.
Kaspersky also says that some changes were made under the hood as well, with the developers adding code virtualization and cross-platform languages for better obfuscation. These techniques, they say, are rarely seen in mobile malware.
The researchers said they reported their findings to both Google and Apple, and that “some” of the malicious apps had already been removed.
Through Hacker News
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
