Hidden Photo Hunt: How a New App Virus Targets Crypto Secrets
A fresh threat has emerged that focuses on the very pictures people keep in their phones. The malware, named SparkKitty, scans photo libraries on both Android and iOS devices to find images that contain wallet recovery phrases or other private data. Once it spots a match, the virus sends the information to servers controlled by attackers.
Timeline & Distribution
- June 2025 – First detected after a security team noticed suspicious activity.
- Spread through major app marketplaces: Apple’s App Store, Google Play, and smaller third‑party stores.
- Hidden inside apps masquerading as legitimate crypto tools, messaging services, or entertainment games.
How It Works
- Installation – Users download the seemingly legitimate app.
- Permission Request – The app asks for permission to view photos.
- Scanning – Once granted, it scans every image for long strings of characters used as recovery phrases.
- Data Exfiltration – Matches are sent to attacker-controlled servers.
Unlike clipboard‑oriented malware, SparkKitty directly examines photo libraries, enabling it to find hidden secrets even if the user never typed or copied them.
Mitigation Advice
- Keep wallet recovery phrases offline: write them on paper or store them in a secure password manager.
- Avoid keeping screenshots of phrases on your phone.
- Limit photo‑library access to apps you truly trust and download software only from reputable developers.
Context & Related Incidents
- March 2025: DarkSword deployed Ghostblade malware targeting major exchanges and wallet apps on iPhones.
- March 2025: FBI investigated several Steam games that installed malware post‑purchase.
- May 2025: An AI company released a tool to spot compromised software packages without running them.
These incidents highlight the increasing attacks on cryptocurrency users. Staying vigilant about app permissions and storage habits can help protect valuable digital assets.
