The SparkCat threat that steals your recovery phrases from your mobile photos

Recently, cyber security researchers have alerted about a renewed variant of malware known as SparkCat that has reappeared in official mobile application stores: both in the App Store Apple as in the Google Play Store. What is disturbing is that installers are not suspicious applications to the naked eye: they are camouflaged within programs that seem safe, such as business messengers or food delivery services, and act quietly in the background.

SparkCat's most dangerous malicious function is its ability to scan the device's photo galleries in search of cryptomoneda coin recovery phrases. This type of phrase - the famous "seed" or mnemonic - allows to restore control over digital wallets; if they fall into the hands of an attacker, asset theft can be practically instant. Researchers of the Russian company Kaspersky They noted the detection of several infected applications on both platforms and explained how malware sends only images containing relevant text to operators controlled servers.

A significant difference between the variants is the linguistic and scope strategy. The version that affects iOS was designed to identify mnemonic phrases in English, making it potentially broader in scope, as it does not depend on a specific regional language. For its part, the Android variant incorporates word search mechanisms in Japanese, Korean and Chinese, pointing to a focus on Asian users.

In addition to language patterns, technical changes in the Android version indicate an evolution in malware sophistication. Developers have added multiple layers of ofuscation to complicate their analysis: from virtualization of the code to the use of multi-platform languages and tools that seek to evade the static and dynamic inspection used by response teams. In other words, SparkCat has learned to hide better and to slow down or confuse analysts.

The exfiltration vector is based on an optical character recognition module (OCR) that analyzes the images stored in the device. When the OCR detects text related to a recovery sentence, the relevant image is transferred to the attacker's server. This technique was first described by Kaspersky in February 2025 and now comes back with improvements, confirming that the malicious project is active and in continuous development.

The researchers have linked the operation to a Chinese-speaking actor and, according to their findings, the similarities between the old and the new samples suggest that those responsible are the same operators or a very related group. The analysis of behaviors and infection chains led experts such as Sergey Puzan to point out the need for mobile safety tools and to pay attention to the permits granted to applications. In his statements to the press, Puzan stressed that malware requests access to photos in certain scenarios and then uses OCR to decide what to send to attackers.

From a practical perspective, this puts recommendations on the table again that any cryptomoneda user should take seriously. Storing a photographic copy of the recovery phrase on the phone makes that copy a target. Hardware wallets and cold storage practices remain the most robust defenses against this type of theft. In addition, carefully review the permissions requested by the applications before installing them and distrust apps that request access to the gallery when they have no clear reason to do so significantly reduces the risk.

Official stores have improved their controls, but incidents show that they are not infallible: malicious applications can pass initial reviews or appear after updates that introduce hostile code. It is therefore recommended to complement native protections with mobile security solutions and to check the reputation of developers before installing. Apple resources on app review and protection tools like Google Play Protect may mitigate risks, although they do not replace the user's prudence.

For those who manage digital assets, it is also appropriate to follow specialized safety guides: manufacturers of purse and platforms such as MetaMask and hardware manufacturers like Ledger offer clear recommendations on how to save the mnemonic phrases and minimize exposure. And, beyond cryptomoneda, keeping the operating system and up-to-date applications reduces the opportunity window for malware to exploit known vulnerabilities.

SparkCat's reappearance recalls that the mobile threat is dynamic: the authors not only re-use ideas, but perfect them. The research published by Kaspersky and the coverage of specialized media such as The Hacker News show that these types of campaigns seek to maximize their impact with relatively simple but effective techniques when finding low-risk users.

In short, the lesson is clear: the comfort of having everything on the phone should not be translated into negligence with the keys (seed phrases) of our digital portfolios. Save a recovery sentence in a mobile photo is inviting the robbery. Taking basic digital hygiene measures and betting on off-line security and storage solutions can make the difference between maintaining or losing control of assets.