The malware targets images that may expose cryptocurrency wallet recovery phrases, passwords, identity documents, QR codes and financial information. Its ability to capture entire photo libraries also creates risks beyond digital-asset theft, including account takeover, identity fraud, surveillance and extortion.
SparkKitty was first documented in June 2025 after being found inside applications distributed through Apple’s App Store, Google Play and third-party websites. Evidence from malware samples indicates that the operation had been active since at least February 2024.
The campaign has primarily targeted users in China and Southeast Asia, particularly people using cryptocurrency trading services and mobile wallets. However, distribution through official application stores increased the potential exposure beyond those markets.
Most SparkKitty versions do not analyse photographs on the infected device. Instead, they indiscriminately upload accessible images for examination by the operators. A related cluster uses optical character recognition to select pictures containing potentially valuable text before exfiltration.
That distinction separates much of SparkKitty’s activity from SparkCat, an earlier mobile stealer linked to the same threat operation. SparkCat deployed optical character recognition models to search images for words associated with cryptocurrency seed phrases and upload selected files.
Technical similarities between the two campaigns include shared infrastructure patterns, cryptocurrency-themed applications, malicious software development kits and the theft of gallery content. Investigators assess that SparkKitty is likely connected to SparkCat rather than being an unrelated malware family.
A seed phrase usually consists of 12 or 24 words that can restore access to a cryptocurrency wallet. Anyone possessing the phrase may be able to recreate the wallet on another device and transfer its assets without knowing the owner’s password.
SparkKitty exploits the practice of saving seed phrases as screenshots. Users also frequently store photographs of passports, driving licences, bank cards, medical records and handwritten passwords, turning a phone’s gallery into a concentrated repository of sensitive information.
On Android, one prominent infected application was SOEX, which presented itself as a messaging service with cryptocurrency exchange functions. The application was downloaded more than 10,000 times through Google Play before it was removed.
Other Android versions were promoted as cryptocurrency investment platforms or distributed through modified TikTok applications and unofficial download pages. Some were advertised through social media and video platforms to direct potential victims towards sideloaded installation files.
The Android payload appeared in Java and Kotlin variants. One Kotlin version operated as a malicious Xposed module, a format associated with software capable of modifying system and application behaviour on rooted or altered devices.
After installation, the malicious code requested access to device storage or media files. Applications containing the Trojan often continued to provide their advertised functions, reducing the likelihood that victims would immediately suspect malicious activity.
Once permission was granted, SparkKitty collected existing images and monitored the gallery for new files. The malware also transmitted device information that could help operators identify victims, manage infections and organise stolen material.
On iOS, the campaign used an application branded 币coin, presented as a cryptocurrency service. The malicious application reached Apple’s App Store before being removed on June 25, 2025, two days after the threat was publicly documented.
Other iPhone infections were delivered through websites designed to resemble Apple’s official marketplace. These sites used legitimate developer distribution mechanisms to persuade users to install applications presented as TikTok modifications, gambling platforms or cryptocurrency tools.
The iOS payload was concealed in malicious frameworks that imitated widely used networking libraries, including components resembling AFNetworking and Alamofire. Other samples disguised malicious code as a Swift system library or embedded it directly within an application.
Command-and-control addresses were sometimes stored in cloud-based configuration files, allowing operators to change server locations without rebuilding the infected application. This technique can complicate detection and help maintain access when malicious infrastructure is blocked.
The campaign shows how criminals are adapting to stronger mobile security controls. Rather than attempting to defeat wallet encryption directly, attackers exploit permissions willingly granted to apparently legitimate applications and search material that users have stored for convenience.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
