SparkKitty Malware Targets Crypto Wallets via App Stores

New Malware Threat Targets Cryptocurrency Wallets

The cybersecurity firm Check Point has unveiled a new malware campaign named SparkKitty, which specifically targets cryptocurrency users by scanning their photo libraries for sensitive information, including wallet recovery phrases. This malware has been detected across various platforms, including Apple's App Store, Google Play, and several third-party app stores.

Initially identified by Kaspersky in June 2025, SparkKitty's distribution method has raised alarms among experts. The malware has spread through applications masquerading as legitimate cryptocurrency tools, messaging services, and even entertainment apps, significantly increasing the chances of unsuspecting users installing them. Check Point emphasized the malware's notable presence on both major app stores, stating, "What makes SparkKitty particularly notable is its presence on both the Apple App Store and Google Play, giving it a wide attack surface."

Once installed and granted access to photo libraries, SparkKitty scans for wallet recovery phrases and uploads the stolen data to servers controlled by the attackers. On iOS, the malware was found in a cryptocurrency app called "币coin," which managed to bypass Apple's review process to gain access to users' photo libraries. For Android users, the malware was present in a messaging and cryptocurrency exchange app named SOEX, which had over 10,000 downloads before its removal.

Unlike traditional information-stealing malware that relies on clipboard monitoring or keylogging, SparkKitty directly targets photo libraries, making screenshots of wallet recovery phrases particularly vulnerable. Experts recommend that users keep their recovery phrases offline, limit photo library access to trusted applications, and only download software from reputable developers to mitigate risks.

This revelation comes amid a rise in malware targeting cryptocurrency users. Previous campaigns include the DarkSword exploit chain, which targeted major exchanges and wallet applications, and recent investigations by the FBI into malware found in games on Valve's Steam platform. Furthermore, Kaspersky reported on malicious downloads disguised as anime-themed wallpapers being used to spread infostealers like Lumma and Vidar.