The SparkKitty spyware campaign is back in the spotlight after reports revealed it targets crypto wallet recovery phrases stored in phone photo galleries on both iOS and Android devices.
This malware collects images from infected phones, scanning them for wallet seed phrases, passwords, and other sensitive data before sending everything to attacker-controlled servers.
Despite recent attention, SparkKitty is not a new threat. Kaspersky first detailed it in June 2025 after finding infected apps on Apple’s App Store and Google Play, as well as through unofficial sources. Renewed coverage by Cyberint in July 2026 has brought it back into focus.
Researchers link SparkKitty to an older malware called SparkCat, which used optical character recognition (OCR) to scan screenshots specifically for wallet seeds. SparkKitty’s approach is broader, often uploading entire galleries rather than selecting images with recovery phrases.
The malware also targets other personal information like passwords, identity documents, and QR codes by using OCR technology. While crypto theft seems the primary motive, some samples lacked conclusive proof.
Active since at least February 2024, SparkKitty mainly hit Southeast Asia and China, spreading through fake crypto tools, altered social apps, gambling apps, and more.
In April 2026, Kaspersky found newer SparkCat variants still using OCR-based gallery theft in apps on official stores, but whether SparkKitty had fully returned then remained uncertain.
On iOS devices, SparkKitty hides in modified frameworks mimicking popular libraries like AFNetworking and Alamofire or in obfuscated files such as libswiftDarwin.dylib. After installation, it requests photo gallery access, then quietly uploads new and previously unseen images to remote servers.
Android versions operate similarly, gaining photo permissions to harvest sensitive images.
Experts recommend keeping wallet seeds offline, restricting photo app permissions, and moving wallets immediately if exposure is suspected.
This article is for informational purposes and does not constitute financial advice.
