SparkKitty Trojan Targets Crypto Wallets via Mobile App Stores

Kaspersky researchers have identified a sophisticated malware campaign dubbed "SparkKitty" infiltrating both iOS and Android ecosystems. The Trojan has compromised over 5,000 cryptocurrency users across Asia by stealing wallet seed phrases from device galleries—a novel attack vector that bypasses traditional security measures.

What sets SparkKitty apart is its successful penetration of Apple's App Store and Google Play, hiding within seemingly legitimate applications including crypto trackers, gambling apps, and modified social media clients. One compromised messenger app, SOEX, achieved 10,000+ downloads before detection, exposing critical vulnerabilities in official app vetting processes.

The malware represents a paradigm shift in crypto theft methodologies. Rather than direct wallet breaches, it targets the weakest link—users' storage of recovery phrases in mobile galleries. Security analysts note this campaign has been active since Q1 2024, with particular prevalence in China and Southeast Asia.