Cybersecurity experts have recently discovered a data-stealing trojan named SparkCat, which has been active on the AppStore and Google Play since at least March 2024. This is the first malware using optical recognition to appear on the AppStore. SparkCat utilizes machine learning to scan image libraries and steal screenshots containing cryptocurrency wallet recovery phrases. It can also find and extract other sensitive data in images, such as passwords.

Method of Spread

This malware is spreading through both infected legitimate apps and decoys, such as messaging apps, AI assistants, food delivery apps, and cryptocurrency-related applications. Some of these apps are currently available on official platforms like Google Play and AppStore. Data from Kaspersky also shows that software versions infected with malware are being distributed through unofficial sources. On Google Play, these apps have been downloaded over 242,000 times.

Figure 1. The ComeCome food delivery app for iOS infected with malware

Figure 2. Negative user feedback about ComeCome

Attackers' Targets

The malware primarily targets users in the UAE and countries in Europe and Asia. SparkCat scans image libraries for keywords in multiple languages, including Chinese, Japanese, Korean, English, Czech, French, Italian, Polish, and Portuguese. However, experts believe victims may also come from other countries.

Figure 3. A fake messaging app on the AppStore related to SparkCat malware

How SparkCat Malware Works

After installation, the malware requests access to view photos in the user's phone library. It then analyzes text in the images using an optical character recognition (OCR) module. If the malware detects relevant keywords, it sends the images to the attacker. The main goal of the hackers is to find recovery phrases for cryptocurrency wallets. With this information, they can fully control the victim's wallet and steal funds. Besides stealing recovery phrases, the malware can extract other personal information from screenshots, such as messages and passwords.

Figure 4. Searching for keywords after extracting text from images

Despite being rigorously screened by official app stores, infected apps still find their way into Google Play and the App Store. What makes this Trojan particularly dangerous is that there are no signs indicating hidden malware within the app. The permissions requested by the app seem necessary for its core functionality and appear harmless at first glance. This case has challenged the notion that iOS is unaffected by threats posed by malicious apps.

List of IOCs Related to SparkCat

Hashes of Infected Android Apps

iOS Framework

Trojan Configuration in GitLab

C2 Server

Photo Storage

hxxps://dmbucket102.s3.ap-northeast-1.amazonaws[.]com

Recommendations

FPT Threat Intelligence recommends several measures for organizations and individuals to prevent this malware:

• If you have installed an infected app, remove it immediately and avoid reinstalling until a patch is available.

• Avoid storing screenshots containing sensitive information, such as cryptocurrency wallet recovery phrases, in your photo library. Store passwords, secure documents, and important data in dedicated security applications.

• Use robust security solutions on all your devices to protect against malware threats.

• User training and awareness: Organize cybersecurity training sessions to help identify phishing, scams, and social engineering attacks.

• Check app permissions on your phone: Only install apps from official sources like Google Play or App Store and review permissions before granting them.

• Regularly update your operating system and applications: Always use the latest versions to reduce the risk of exploitation by security vulnerabilities.

References

• Kaspersky discovers new crypto-stealing Trojan in AppStore and Google Play

• Take my money: OCR crypto stealers in Google Play and App Store