Since at least February 2024, the SparkKitty malware has been pulling photos from the galleries of iOS and Android users. It hunts for seed phrases saved as images. In April 2026, Kaspersky reported a new SparkCat variant that detects English-language recovery phrases for the first time.
SparkKitty and SparkCat are malicious programs that hide inside seemingly harmless mobile apps. After installation, they access the photo gallery and upload stored images to external servers. The target is screenshots of wallet recovery phrases. Instead of keeping them on paper, many users store them on the phone. Kaspersky first described SparkCat in early 2025. The security vendor classified that campaign as the first known OCR trojan in the Apple App Store. Its SparkKitty report followed later, in June 2025. Yet that campaign had been running since at least February 2024. Infected applications originally included the app "币coin" in the Apple App Store and the messenger "SOEX" on Google Play. Apple and Google have since removed both applications.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
New SparkCat variant targets English-speaking users for the first time
Kaspersky reported the new variant in April 2026, more than a year after SparkCat first surfaced. It appeared on the Apple App Store and Google Play at the same time. On Android, it affected the app "SafeX" in version 2.1.0, which ran under the package name com.ekhizc.carterocourrier. In the Apple App Store, analysts found two further applications, "SafeW - 云办公助理" and "悟空外卖: 泰国华人生活管家". The Android variant also hides its code behind code virtualization. Moreover, cross-platform programming languages make analysis harder.
What matters most, however, is the choice of languages. The Android variant still searches for Japanese, Korean and Chinese keywords. On iOS, in contrast, the malware scans for English-language mnemonic phrases for the first time. A single phrase is enough to restore a wallet on any device. That points to a possible expansion of the target audience beyond Asia.
The number of users who installed the affected apps remains unclear. So far, reliable installation figures exist only for the earlier wave. Nevertheless, the finding carries weight, because the campaign passed the review processes of both stores once again.
How the SparkKitty malware scans photos for seed phrases
The name suggests a targeted search. Yet most SparkKitty variants work crudely and upload every image in the gallery, regardless of content. The analysis happens only at the attackers' end. A related activity cluster, however, proceeds more selectively and uses text recognition from Google ML Kit. As a result, this cluster uploads only images with at least three lines of text. Each line must contain one word of three letters or more.
SparkCat, in contrast, relies on OCR throughout and searches directly for mnemonic phrases. The two campaigns thus differ mainly in their degree of automation. The disguise follows the platform in each case. On iOS, the malicious code sits in fake network frameworks such as AFNetworking and Alamofire. In addition, a file named libswiftDarwin.dylib poses as a system library. On Android, it runs through malicious modules for Xposed or LSPosed.
The operators encrypt only the configuration of their control servers, using AES-256-ECB. They stored that configuration on Aliyun OSS and on Gitee, the Chinese counterpart to GitHub. Kaspersky also identified several command-and-control servers. Because the affected apps still delivered their advertised function, the photo leak rarely stood out in everyday use.
Disguises in app stores and TikTok clones
"币coin" appeared in the Apple App Store as an information service for crypto prices. "SOEX", meanwhile, is a messenger with trading features that reached more than 10,000 installations on Google Play. Apple and Google removed the applications after Kaspersky's report. Google confirmed the removal and banned the developer.
Outside the official stores, SparkKitty also spread through modified TikTok clones with fake crypto shops. Other carriers included gambling apps, casino offerings and adult games. On iOS, attackers further used enterprise provisioning profiles. Companies use these profiles for internal app distribution. That route therefore bypasses the store entirely. The picture with SparkCat looked similar in early 2025. Kaspersky found two infected apps in the Apple App Store back then and one on Google Play. There, the malicious function hid in corporate messengers and in food delivery apps.
Both campaigns initially targeted Asia, with SparkKitty focused on China and Southeast Asia. Moreover, Kaspersky links the two campaigns through jointly infected Android apps and matching debug symbols in the iOS frameworks. The company suspects a Chinese-speaking threat actor behind SparkCat. Yet both campaigns passed store review, which puts the protective value of that review into perspective.
Protection against seed phrase theft from the gallery
The most effective measure is the simplest one. A seed phrase therefore does not belong in a phone's gallery as a photo or screenshot. Anyone who already holds such images should delete them, or at least move them to encrypted offline storage. Hardware wallets keep the phrase off the smartphone permanently.
Similarly, a look at app permissions helps. A price tracker or a messenger rarely needs full access to the entire photo library. Official stores nevertheless remain the better choice over third-party sources. But they guarantee no protection, as the "币coin" and "SOEX" cases show. Consequently, users should check developer reputation and permission requests before installing.
