Your Seed Phrases Are Being Stolen by Mobile Malware Through Official App Stores
A dangerous new mobile spyware campaign targeting cryptocurrency users has infiltrated both Appleâs App Store and Google Play Store, specifically designed to steal seed phrases and wallet credentials stored as photos on smartphones. The malware, dubbed SparkKitty, represents a significant escalation in mobile cryptocurrency threats and has already compromised thousands of users worldwide.
Advanced Malware Campaign Targets Crypto Assets
SparkKitty, a successor to the earlier SparkCat campaign first uncovered in early 2025, uses modified frameworks and libraries to exfiltrate sensitive data from iOS and Android devices. Unlike traditional malware that spreads through unofficial channels, this sophisticated threat has been confirmed inside multiple legitimate apps available through official app stores.
The malware campaign demonstrates alarming technical sophistication. A messaging app with crypto exchange features accumulated over 10,000 installs on Google Play, while an iOS app called «ćžcoin» was disguised as a portfolio tracker. This approach allowed the malware to bypass standard security screening processes that typically protect official app stores.
Kaspersky researchers discovered that the malware specifically targets images containing seed phrases and private keys using advanced optical character recognition (OCR) technology. Once detected, these critical cryptocurrency credentials are immediately flagged and transmitted to attacker-controlled servers, potentially resulting in complete wallet compromise.
Read full article in blog
Follow us:
Twitter
https://x.com/godbex_io
Telegram
https://t.me/godbex_io
Exchanger
https://godbex.io/