- SparkCat information stealer hidden in iOS App Store and Play Store apps
- Targets cryptocurrency seed phrases via OCR and keywords
- New obfuscation techniques make detection more difficult
SparkCat, a mobile-focused information stealer that targets users’ cryptocurrencies, is back with new upgrades that make it harder to spot.
Cybersecurity researchers Kaspersky say they found several apps in both the Apple App Store and Google Play Store providing the malware.
Apple and Google’s app repositories are generally safe, and knowing the size and popularity of the platforms, both companies go the extra mile to ensure that the apps offered there are clean. However, from time to time, malicious actors manage to bypass the perimeter and smuggle in malicious applications.
Article continues below
Looking for mnemonics
In this case, Kaspersky said it discovered business messaging and food delivery service apps hiding SparkCat.
This information stealer was first spotted in 2025, looking for people’s mnemonic seeds, or “seed phrases” – a set of 12 or 24 seemingly random words that can be used to load a person’s cryptocurrency wallet onto another device as a backup in case the device is lost or crashes.
SparkCat recently made headlines for how it used optical character recognition (OCR) to extract seed phrases from photos and screenshots. It primarily targeted Asian users, and while the new version still does the same thing, it has taken the extra step to potentially target Western users as well.
The Android version always searches for Japanese, Korean and Chinese keywords. The iOS version, however, searches for English mnemonics.
Kaspersky also says that some changes have also been made under the hood, with developers adding code virtualization and cross-platform languages for better obfuscation. According to them, these techniques are rarely used in mobile malware.
The researchers said they reported their findings to Google and Apple, and that “some” of the malicious apps had already been removed.
Via Hacker news
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
