Cybersecurity experts have identified a new mobile malware called SparkKitty, which is targeting smartphone users through fake applications. This malware steals images and screenshots from users' photo galleries. These may contain cryptocurrency wallet recovery phrases or other sensitive information. SparkKitty has been found on both Android and iOS platforms and experts say it poses a serious threat to users who manage digital assets from their phones.

What is SparkKitty malware?

SparkKitty is a Trojan Virus, which looks like a real app but performs dangerous activities in the background. Security researchers have found that it hides itself in many fake apps, such as crypto converters, messaging apps, and unofficial versions of social media app TikTok. Surprisingly, some of these apps were also uploaded to official app stores but were removed after the report.

SparkKitty is the mobile version of the old SparkCat malware, which previously targeted macOS and Windows systems. Kaspersky's SecureList researchers have found many similarities in both malware. This makes it clear that attackers are now targeting smartphone users more because people have started managing their financial data from mobile.

How does SparkKitty work?

When a user downloads a fake app in which SparkKitty is hidden, it asks for access to the phone's photo gallery. Android scans all the images in the phone's gallery and identifies screenshots that contain text, such as crypto wallet recovery phrases or QR codes. Talking about the iPhone, this malware bypasses the system limitations using common coding libraries and accesses photos and device information saved in the phone.

Its main purpose is to hack users' cryptocurrency wallets. People often save their wallet's Seed Phrase or Recovery Phrase as a screenshot for convenience. However, these unprotected image files can easily be stolen through malware. After this, hackers use these recovery phrases to hack the wallet and steal money, and the user does not even know.

Where is this virus spreading?

Although at present this malware is mainly targeting users of Southeast Asia and China, cyber experts say that its methods of spreading make it capable of spreading all over the world. It is spreading through the Play Store, App Store and third-party websites. The names, icons, and fake user reviews of fake apps look so reliable that common users get deceived.

How to protect your phone?

Never save important data like bank details, passwords, or recovery phrases of crypto wallets in screenshots. Keep it safe offline, in paper or hardware wallets.

Give apps access to photo galleries only when it is very important.

Check your phone's App Permissions from time to time and remove unnecessary access.

Install only trusted and official apps.

Always keep your phone's software and security patch updated.

If an app looks suspicious—if it was downloaded from the Play Store or App Store—delete it immediately.

Disclaimer: This content has been sourced and edited from Amar Ujala. While we have made modifications for clarity and presentation, the original content belongs to its respective authors and website. We do not claim ownership of the content.