A newly discovered strain of mobile malware, dubbed SparkKitty, has been found in various apps on Apple's App Store and Google Play, disguising itself as cryptocurrency-themed and modified apps to secretly extract images of sensitive information such as seed phrases and wallet credentials. This malicious software appears to be an evolution of the SparkCat campaign, which was first identified in early 2025 and utilized fake support chat modules to silently access and exfiltrate sensitive screenshots from user galleries. According to Kaspersky researchers, SparkKitty takes this strategy to the next level. Unlike its predecessor, which primarily spread through unofficial Android packages, SparkKitty has been confirmed to be embedded in multiple iOS and Android apps available for download through official stores.
These include a messaging app with cryptocurrency exchange features, which has been installed over 10,000 times on Google Play, and an iOS app called "币coin", masquerading as a portfolio tracker. The iOS variant of the malware utilizes a modified version of the AFNetworking or Alamofire framework, where attackers have embedded a custom class that automatically runs when the app is launched, using Objective-C's +load selector. Upon startup, it checks a hidden configuration value, fetches a command-and-control address, and scans the user's gallery, beginning the process of uploading images. A command-and-control address provides the malware with instructions on what actions to take, such as when to steal data or send files, and also receives the stolen information.
The Android variant achieves the same goal through the use of modified Java libraries. Optical Character Recognition (OCR) is applied via Google ML Kit to parse images.
If a seed phrase or private key is detected in an image, the file is flagged and sent to the attacker's servers. Installation of the malware on iOS devices is facilitated through enterprise provisioning profiles, a method intended for internal enterprise apps but often exploited for malicious purposes. Victims are deceived into manually trusting a developer certificate linked to "SINOPEC SABIC Tianjin Petrochemical Co.
Ltd.", thereby granting SparkKitty system-level permissions. Several command-and-control addresses have been found to use AES-256 encrypted configuration files hosted on obfuscated servers. Once decrypted, these files point to payload fetchers and endpoints, such as /api/putImages and /api/getImageStatus, which the app uses to determine whether to upload or delay photo transmissions.
Kaspersky researchers have discovered other versions of the malware that utilize a spoofed OpenSSL library (libcrypto.dylib) with obfuscated initialization logic, indicating an evolving toolkit and multiple distribution vectors. Although most of the targeted apps appear to be focused on users in China and Southeast Asia, there is nothing inherent in the malware that limits its regional scope. Following disclosure, Apple and Google have removed the offending apps from their stores. However, the campaign is believed to have been active since early 2024 and may still be ongoing through side-loaded variants and clone stores, according to researchers.