Kaspersky Uncovers SparkKitty Spyware Targeting Crypto Seed Phrases via Official App Stores

Kaspersky researchers have identified a new mobile malware campaign dubbed SparkKitty, which stealthily harvests cryptocurrency seed phrases from compromised devices. The spyware infiltrates both iOS and Android platforms through official app distribution channels, including Google Play and the App Store, masquerading as legitimate software libraries.

The malware employs optical character recognition (OCR) to scan device screenshots for sensitive crypto wallet information. Android variants written in Kotlin function as malicious Xposed modules, while iOS payloads disguise themselves as common development frameworks like AFNetworking or Alamofire. Google has already removed identified malicious apps from Play Store following researcher notifications.

This discovery follows Kaspersky's earlier exposure of the SparkCat malware targeting cryptocurrency wallets, suggesting an escalating threat landscape for digital asset holders. The campaign has been operational since at least January 2025, with attackers evolving their techniques to bypass platform security measures.