- Published on
SparkKitty Malware Found in App Stores Targets Crypto Wallet Seed Phrases
- Authors
- Name
- DeepHorus
A new malware campaign dubbed SparkKitty is targeting cryptocurrency users by scanning their photo libraries for wallet recovery phrases, according to a report from cybersecurity firm Check Point. The malware was discovered in June 2025 by Kaspersky and has since been found on Apple's App Store, Google Play, and various third-party app stores, making it a widespread threat to both iOS and Android users.
SparkKitty operates by tricking users into granting access to their photo libraries through malicious apps disguised as legitimate cryptocurrency tools, messaging platforms, and entertainment applications. Once permission is granted, the malware scans stored images for wallet seed phrases and other sensitive information, then uploads the data to attacker-controlled servers. This approach differs from traditional information stealers that rely on clipboard monitoring or keylogging.
On iOS, the malware was distributed through a cryptocurrency app called "币coin" available on Apple's App Store. Check Point noted that the app concealed its malicious code to evade Apple's review process before requesting photo library access. On Android, SparkKitty appeared in a messaging and cryptocurrency exchange app named SOEX, which was downloaded more than 10,000 times from Google Play before being removed. Other variants were spread through third-party stores, fake TikTok apps, gambling apps, and sideloaded APKs.
The presence of SparkKitty on official app stores highlights the evolving sophistication of malware distribution. Check Point stated, "What makes SparkKitty particularly notable is its presence on both the Apple App Store and Google Play, giving it a wide attack surface." Researchers emphasize that storing wallet recovery phrases as screenshots exposes users to significant theft risk, as the malware directly targets these images.
In response to the threat, cybersecurity experts recommend keeping wallet recovery phrases offline, limiting photo library permissions to trusted apps, and downloading software only from reputable developers. These precautions are critical given that similar campaigns have been on the rise, including the DarkSword exploit chain targeting iPhone users and malware-laced games on Steam.
The SparkKitty discovery follows a string of high-profile malware campaigns in 2025. In March, Google disclosed the DarkSword exploit chain deploying Ghostblade malware, while the FBI investigated games on Valve's Steam platform for installing malware. In May, AI startup Perplexity open-sourced Bumblebee, a detection tool, after a supply-chain attack affected over 160 developer packages. Kaspersky also reported attackers using Steam Workshop to distribute infostealers like Lumma and Vidar.
Looking ahead, security experts warn that malware targeting cryptocurrency assets will continue to evolve, exploiting user trust and platform vulnerabilities. Users are urged to adopt rigorous security practices, including avoiding screenshot storage of sensitive data and regularly auditing app permissions. As the crypto ecosystem grows, so too will the sophistication of threats like SparkKitty, making vigilance essential for protecting digital assets.
