How the ‘SparkKitty’ Trojan Is Stealing Crypto Wallet Data From Phones

The newly discovered Trojan called “Sparkitty” infects smartphones and releases sensitive data, potentially allowing attackers to exhaust the CRIPTO CRIPTO CRIPTO banknotes, a kibernetic safety company Kaspersky said In a report on Tuesday.

The malicious software is installed in applications associated with crypto trading, gambling and even modified versions of the ticter.

Once installed through deceptive providing profiles – used to start an IOS app or modified applications – Sparkitty requires access to the photo gallery. He monitors changes, creates a local database of stolen images and transmits photos to a remote server.

“We doubt the main goal of the attacker is to find the shots of the Crypto wallet phrase,” Kaspersky said.

Currently, malicious software primarily targets the victim in China and Southeast Asia. However, the company warned that nothing would be prevented from spreading to other regions.

In his 2024 report, TRM Labs estimated that almost $ 70% of $ 2.2 billion stolen cryptocurrencies last year the result of infrastructure attacks, especially those involving the theft of private keys and seed phrases.

Infected devices

Malicious software like Sparkitty allows such stealing as attackers can use data from infected devices look for Wahatel of loans. Seed phrases are very valuable as they allow complete access to the user’s crypto wallet.

It is believed that Sparkitty is associated with Sparkat Spyware campaign for the first time discovered in January 2025, which similarly used the malicious SDK to get access to photos on user devices.

While Sparkcat focused its spy software on pictures with seed phrases using optical character recognition (OCR technology, Sparkkitty is unnecessarily transmitted photos, it is assumed that it will be processed later.

Its presence is confirmed by both Android and iOS applications at their app stores, including disguised in the tools for the themes of the theme and tictic modes.

Sparkkitty joins a multitude of other cryptocurrency of malicious software and Trojans who have gained popularity among hackers in recent years.

Among them was a stolen Reodlofil information establish Built -in in AI tools available to download online, taking advantage of the current interest in technology.

Hackers build convincing AI websites and then advertising them through social media to attract no suspicious victims.

International effort to enforce law in May Targets Key infrastructure associated with the distribution of another strain of malicious software, Lummac2, which is associated with more than 1.7 million stealing attempts.

Lummac2 aimed to steal information related to credentials for registration, including for the crypto banknotes.

Edited Sebastian Sinclair