Security researchers have uncovered a malicious software strain named SparkKitty, designed to harvest seed phrase screenshots from smartphone photo galleries. Unlike many forms of malware that need explicit vulnerabilities, this threat functions by scanning users’ image folders after gaining access through malicious apps. These apps often masquerade as crypto related utilities or messaging platforms with embedded trading tools.
Once installed, the malware continuously monitors camera roll changes and uploads captured images to remote servers. Advanced OCR technology is used to analyze images for text strings resembling seed phrases, and when found, attackers execute wallet extraction routines to drain funds. The apps containing this malware have sometimes infiltrated official app stores, while others are distributed via cloned sites offering familiar applications.
Affected users are being urged to take immediate action: revoke photo permissions from untrusted apps, avoid storing seed phrases as screenshots, and maintain up to date mobile security. Additionally, researchers recommend exclusive use of reputable apps from verified sources, and activation of multifactor authentication for all crypto services.
This event highlights evolving threats as cybercriminals leverage smartphone habits to power exploits. In the growing realm of on device finance, personal devices become key attack vectors. Experts now stress the need for stronger wallet hygiene, regular backups on secure hardware, and increased public awareness regarding mobile malware threats.
