logo

New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images

ID: b5bb619d-6f63-5116-aabf-16f095f43b81

STIX ID: report--b5bb619d-6f63-5116-aabf-16f095f43b81

Feed Name: The Hacker News

Threat Score
75/100

Date Published: 2026-04-03

Date Updated: 2026-04-24

Author: [email protected] (The Hacker News)

...
...

Kaspersky researchers discovered updated SparkCat mobile malware in apps on the Apple App Store and Google Play Store that conceal themselves in legitimate apps and use OCR to scan photo libraries for cryptocurrency wallet recovery phrases, exfiltrating images to attacker servers; the Android variant adds obfuscation and Asian-language keyword scanning while the iOS variant searches for English mnemonics, increasing potential reach.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.