SparkKitty Malware Steals Crypto Wallet Seed Phrases From iOS and Android Photos

Cybersecuritynews •Tushar Subhra Dutta • July 27, 2026

A new mobile threat is quietly targeting cryptocurrency users by reading the photos stored on their phones. Known as SparkKitty, this malware works on both iOS and Android devices and focuses on stealing wallet seed phrases hidden inside screenshots and gallery images. Instead of logging keystrokes or watching the clipboard, it uses optical character recognition […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SparkKitty Malware Targets Crypto Users via App Stores and Photo Galleries SparkKitty is a newly identified cross-platform malware that targets cryptocurrency users by scanning photos on both iOS and Android devices for wallet recovery phrases. It spreads through trojanized applications disguised as legitimate tools, such as a cryptocurrency tracking app called 币coin on the App Store and a messaging app named SOEX on Google Play, which had over 10,000 downloads before removal. The malware employs optical character recognition (OCR) to extract sensitive information from images, including screenshots of wallet seed phrases. This threat is notable for its ability to bypass security measures in both app stores, raising concerns about the effectiveness of current vetting processes. Kaspersky first reported SparkKitty in June 2025, and it appears to be an evolution of a previous malware known as SparkCat. Users are advised to limit photo library permissions and avoid storing sensitive information in screenshots. Both Apple and Google have removed the infected applications following disclosures. 12 sources 72

Extracted Entities

SparkKitty Malware Steals Crypto Wallet Seed Phrases From iOS and Android Photos

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)