BlockBeats News, July 27th. According to Check Point, a cross-platform malware named SparkKitty has been disclosed to spread through the Apple App Store, Google Play, and third-party Android app stores. It uses Optical Character Recognition (OCR) technology to scan images in users' albums to find sensitive information such as wallet mnemonic phrases, passwords, and QR codes.

The report states that SparkKitty is an upgraded version of the previous information-stealing malware SparkCat, disguised as applications such as cryptocurrency services, messaging tools, and entertainment platforms. Once installed, the app requests access to the user's photo library and continuously scans existing and newly added images, uploading the identified text along with device information to the attacker's server.

On the iOS platform, the malicious code was inserted into a cryptocurrency app called "Coin" and managed to bypass Apple's review through code obfuscation. On the Android platform, researchers found that the malicious software was distributed within a chat and crypto transaction app named "SOEX," which was taken down from Google Play only after exceeding 10,000 downloads. Additionally, the attackers also spread this malware through third-party app stores, sideloaded APKs, modified versions of TikTok, and entertainment apps.

Check Point warns that if users store their wallet mnemonic phrases as screenshots or photos, once stolen, attackers can take full control of the corresponding cryptocurrency wallet. Security experts recommend not keeping mnemonic phrases in the phone's album, opting for offline storage (such as paper or hardware wallet backup). Users are advised to be cautious when granting photo library permissions to apps and only download applications from trusted sources.