SparkCat crypto stealer in Google Play and App Store
Essential information
- Published
- 06/02/2025 17:06
- Modified
- 06/02/2025 22:54
- Tags
- 2025-02-06 android app store crypto-stealer google play ios ml kit ocr rust sparkcat
- Related entities
- 9 observables, 14 techniques (mitre), 1 malware, 5 others
Description
A new malware campaign dubbed 'SparkCat' has been discovered targeting Android and iOS users through both official and unofficial app stores. The malware, embedded in various apps, uses OCR technology to scan users' image galleries for crypto wallet recovery phrases. Infected Android apps on Google Play had over 242,000 downloads. This marks the first occurrence of such a stealer in Apple's App Store. The malware utilizes Google's ML Kit for OCR and communicates with C2 servers using a custom Rust-based protocol. Active since March 2024, SparkCat affects users in Europe and Asia, targeting multiple languages. The campaign highlights the vulnerability of both Android and iOS platforms to sophisticated malware threats.