Kaspersky researchers have uncovered malware apps on Google’s Play Store and, for the first time, on Apple’s App Store that harbor a malicious framework aimed at stealing crypto wallet recovery phrases. These phrases are crucial for accessing cryptocurrency in digital wallets. Dubbed “SparkCat” by researchers, this malware is thought to have been in circulation since March 2024.
Jake Peterson for LifeHacker:
If you downloaded one of these apps on either iOS or Android, the app would likely ask permission to access your photo library, then the malicious framework would launch an optical character recognition (OCR) plug-in to scan and identify text in your images. If the program found text that matched certain keywords, it would then send those images to a remote server. The idea here is to scan your library looking for screenshots that reveal the recovery phrases in your crypto wallet and send them back to the thieves who could then use those phrases to break in and steal from accounts.
One of the first apps to arouse suspicious of Kaspersky researchers was a Chinese food delivery app called ComeCome. It’s still available on both iOS and Android, and is the first known app infected with OCR malware to appear on Apple’s App Store, according to Kaspersky.
MacDailyNews Note: More info about SparkCat via Kaspersky here.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
The post Researchers find photo-scanning malware on Apple’s App Store for the first time appeared first on MacDailyNews.
