SparkKitty Malware Found in App Stores Targets Crypto Wallet Seed Phrases

A new report from cybersecurity firm Check Point details how the SparkKitty malware campaign targeted cryptocurrency users by scanning photos stored on infected Android and iPhone devices for wallet recovery phrases and other sensitive information.

First discovered by Kaspersky in June 2025, Check Point’s analysis detailed how the malware spread through Apple’s App Store, Google Play, and third-party app stores.

“What makes SparkKitty particularly notable is its presence on both the Apple App Store and Google Play, giving it a wide attack surface,” Check Point wrote. “The threat actor behind SparkKitty distributed trojanized applications disguised as legitimate cryptocurrency tools, messaging platforms, and even entertainment apps—greatly increasing the likelihood of installation by unsuspecting users.”

After users granted access to their photo libraries, the malware scanned stored images for wallet recovery phrases and other sensitive information before uploading the data to attacker-controlled servers.

On iOS, SparkKitty was distributed through a cryptocurrency app called “币coin” that was available on Apple’s App Store. Check Point said the app concealed its malicious code to evade Apple’s review process before requesting access to users’ photo libraries. On Android, the malware appeared in a messaging and cryptocurrency exchange app called SOEX, which was downloaded more than 10,000 times from Google Play before being removed. Other variants were distributed through third-party app stores, fake TikTok apps, gambling apps, and sideloaded APKs.

Unlike many information stealers that rely on clipboard monitoring or keylogging, SparkKitty searched users’ photo libraries directly, making screenshots of wallet recovery phrases a prime target.

Researchers recommend keeping wallet recovery phrases offline instead of storing them as screenshots, limiting photo library permissions to trusted apps, and downloading software only from reputable developers.

The report follows a string of malware campaigns targeting cryptocurrency users. In March, Google disclosed the DarkSword exploit chain, which deployed Ghostblade malware capable of targeting major cryptocurrency exchanges and wallet apps while stealing messages, passwords, photos, and other data from vulnerable iPhones. That same month, the FBI launched an investigation after several games distributed through Valve’s Steam platform—including “Chemia,” “PirateFi,” and “Tokenova”—were found to install malware.

In May, AI startup Perplexity open-sourced Bumblebee, a security tool designed to detect compromised software packages, browser extensions, and AI connector configurations without executing potentially malicious code following a software supply-chain attack that affected more than 160 developer packages.

In June, Kaspersky reported that attackers were using Steam Workshop to distribute malicious Wallpaper Engine downloads disguised as anime-themed desktop wallpapers. The campaign deployed Lumma and Vidar infostealers, malware commonly used to steal browser credentials and cryptocurrency wallet data.