Kaspersky Labs: The Android and iOS application development kits contain cryptocurrency stealing malware

ChainCatcher news, according to Cointelegraph, cybersecurity company Kaspersky Labs has stated that a malware development kit used to create applications on the Google Play Store and Apple App Store is scanning user images for cryptocurrency wallet recovery phrases in order to steal funds.

Kaspersky Labs reported that once the malware named SparkCat infects a device, it uses optical character recognition (OCR) tools to search images for specific keywords in different languages. The intruders steal the recovery phrases of cryptocurrency wallets, which are sufficient for them to gain full control over the victim's wallet and further steal funds.

The flexibility of this malware allows it not only to steal secret phrases but also to extract other personal data from the photo gallery, such as message content or passwords that may be left on screenshots. The report advises against storing sensitive information in screenshots or mobile photo galleries and recommends using password managers. Additionally, it suggests deleting any suspicious or infected applications. The report states that the source of the malware is unclear and cannot be attributed to any known organization, but it is similar to an activity discovered by ESET researchers in March 2023.