SparkKitty Malware Targets Crypto Wallet Recovery Phrases

A report from cybersecurity firm Check Point reveals the presence of SparkKitty malware in popular app stores, specifically targeting cryptocurrency users. This malware can scan photos stored on infected iPhones and Android devices for sensitive information, including cryptocurrency wallet recovery phrases.

First discovered by Kaspersky in June 2025, SparkKitty has spread through both the Apple App Store and Google Play, accessing a broad range of potential victims. Check Point notes, “What makes SparkKitty particularly notable is its presence on both the Apple App Store and Google Play, giving it a wide attack surface.” The malware was disguised as legitimate applications, including cryptocurrency tools and messaging platforms, increasing the likelihood that users would install them without suspicion.

Once users granted access to their photo libraries, SparkKitty began scanning for wallet recovery phrases and other sensitive data, which it then uploaded to servers controlled by the attackers. Notably, on iOS, SparkKitty was distributed through a cryptocurrency app called "币coin" that was able to conceal its malicious code from Apple’s review process. For Android users, the malware was present in an app named SOEX, which had reportedly been downloaded over 10,000 times before removal from Google Play. Additional variants of the malware were also found in third-party app stores and fake applications.

Unlike traditional malware that relies on methods like clipboard monitoring or keylogging, SparkKitty directly searches through users’ photo libraries, making any stored screenshots of wallet recovery phrases prime targets for theft. Cybersafety experts recommend that users keep their wallet recovery phrases offline and not in easily accessible formats like screenshots to mitigate these risks.