New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images

A new variant of the SparkCat malware has been discovered on both the Apple App Store and Google Play Store, targeting cryptocurrency wallet recovery phrases via OCR.

• •The malware hides within seemingly legitimate apps such as enterprise messengers and food delivery services
• •It uses an OCR module to scan victims' photo galleries for cryptocurrency wallet mnemonic phrases
• •The Android variant adds obfuscation layers including code virtualization and cross-platform language use, and scans for Japanese, Korean, and Chinese keywords
• •The iOS variant scans for English mnemonic phrases, giving it broader geographic reach
• •Kaspersky, which first documented SparkCat in February 2025, attributes the operation to a likely Chinese-speaking threat actor