New ’SparkKitty’ Trojan Targets Crypto Wallets via Mobile Apps

A sophisticated malware campaign dubbed SparkKitty is infiltrating smartphones through compromised apps on official and third-party stores. The Trojan, linked to earlier SparkCat spyware operations, specializes in exfiltrating photo library contents—with attackers likely hunting for screenshots of cryptocurrency seed phrases.

Disguised as crypto trading, gambling, or modified TikTok apps, SparkKitty uses iOS provisioning profiles to gain persistent access. Kaspersky researchers confirm the malware creates a local image database and uploads sensitive files to remote servers. While currently concentrated in China and Southeast Asia, the threat exhibits clear potential for global spread.

The emergence follows TRM Labs' findings that infrastructure attacks—particularly private key and seed phrase theft—accounted for 70% of 2023's $2.2 billion crypto thefts. This malware family demonstrates how mobile devices are becoming critical attack vectors in the digital asset security landscape.