Hackers Steal Crypto Wallet Seed Phrases from Image Galleries

cryptonews.ruPubblicato 2026-07-27Pubblicato ultima volta 2026-07-27

Introduzione

A new type of malware called SparkKitty is using optical character recognition (OCR) to steal cryptocurrency wallet seed phrases directly from photos and screenshots in a device's gallery, bypassing traditional keylogging defenses. Once installed from malicious apps posing as legitimate crypto services on the Apple App Store and Google Play, it requests photo access, scans images for confidential data like passwords and seeds, and sends it to hackers' servers. Control of a seed phrase gives attackers complete access to drain the wallet. Initially detected as SparkCat, the evolved SparkKitty was found in the iOS app 币coin (hiding in obfuscated code) and the Android app SOEX (downloaded over 10,000 times). This method allows theft even when sensitive data is never typed or copied. The report comes alongside news of other attacks, like a method to hijack Telegram Desktop sessions bypassing 2FA.

After installation, the infected program requests access to photos, scans images for confidential information, and sends the results to remote servers controlled by attackers. SparkKitty does not use traditional data interception methods, such as keylogging or clipboard tracking, but rather optical character recognition (OCR) technology to extract text directly from photos and screenshots. This allows it to bypass standard security systems and steal passwords, seed phrases, and other secret data, even if they are not entered via the keyboard or copied to the clipboard, explained Check Point analysts.

If attackers obtain a seed phrase, they gain full control of the crypto wallet and can empty it in a matter of minutes. The malicious program operates covertly in the background, so the device owner may not immediately notice the theft of funds—until they log into their crypto wallet.

The malicious program was first discovered by Kaspersky experts in early 2024 under the name SparkCat. But now the program has changed. The creators of SparkKitty have started distributing it more frequently in the Apple App Store and Google Play under the guise of applications mimicking legitimate cryptocurrency services, messengers, and entertainment services. This has significantly increased the likelihood of installation by unsuspecting users.

For iOS devices, the malicious program was embedded in the cryptocurrency app "币coin" and uploaded to the App Store. It remains unclear whether the developer account was hacked or if the developer is aware of the infection. The app managed to bypass Apple's security review by hiding malicious code within obfuscated frameworks AFNetworking and libswiftDarwin.dylib. These modules were crafted so that the app appeared legitimate, allowing SparkKitty to evade detection, explained Check Point specialists.

The Android version was distributed through the SOEX app, which was downloaded over 10,000 times from Google Play. The app posed as a messaging and cryptocurrency platform but allowed hackers to access multimedia storage on smartphones and other devices, track file changes, and steal data.

Recently, experts from SlowMist discovered a new method hackers use to intercept Telegram Desktop sessions, bypass two-factor authentication (2FA), and steal crypto wallet data. Recently, the CEO of the financial platform Robinhood, Vlad Tenev, was targeted—his X (formerly Twitter) account was hacked to promote the meme coin VLAD.

Domande pertinenti

QWhat is the name of the new malware that steals seed phrases from cryptocurrency wallets using OCR technology?

ASparkKitty

QWhat is the primary technique used by the SparkKitty malware to steal sensitive information, and why is it effective?

AIt uses Optical Character Recognition (OCR) to extract text directly from photos and screenshots. This is effective because it bypasses standard security systems by stealing data that is not typed on a keyboard or copied to the clipboard.

QWhich major app stores are mentioned as distribution channels for the disguised SparkKitty malware?

AApple App Store and Google Play

QWhat was the method used by the iOS version of SparkKitty to hide its malicious code and evade Apple's security checks?

AIt hid the malicious code in obfuscated frameworks, specifically AFNetworking and libswiftDarwin.dylib.

QWhat other recent attack vector, unrelated to SparkKitty, is mentioned where hackers bypassed Telegram Desktop's two-factor authentication?

AExperts from SlowMist discovered a new method hackers use to hijack Telegram Desktop sessions, bypassing two-factor authentication (2FA) to steal cryptocurrency wallet data.

Letture associate

Ethereum Experiences a 43-Day Queue for Staking: But According to One Expert, This Is Not a True Bull Signal

A 43-day queue has formed for staking on Ethereum, with about 2.5 million ETH awaiting activation due to a surge in new validators. However, Thomas Brunner of Sygnum Bank cautions that this backlog should not be seen as a direct bullish signal. He explains it reflects institutional demand but is heavily influenced by Ethereum's protocol mechanics, like the post-Dencun daily validator activation limit of ~57,600 ETH, unchanged with the Pectra upgrade. Pectra allows topping up existing validators, but even small additions join the same activation queue as new stakers. Therefore, the queue comprises not just new investor demand but also restaking and reward compounding from existing participants. Brunner suggests a stronger positive signal is the nearly empty withdrawal queue, indicating current stakers are holding. He notes institutional interest persists despite ETH price weakness, viewing staking yield as a core feature, though privacy concerns over on-chain traceability remain a key barrier to faster institutional adoption.

cryptonews.ru46 min fa

Ethereum Experiences a 43-Day Queue for Staking: But According to One Expert, This Is Not a True Bull Signal

cryptonews.ru46 min fa

Bank of Korea Reveals Results of Tokenized Deposit Testing

The Bank of Korea has announced the results of its pilot test for tokenized deposits. Involving 28 central banks and international financial organizations, the project saw participation from major South Korean banks including KB Kookmin Bank, NH NongHyup Bank, Shinhan Bank, Woori Bank, and Hana Bank. Transactions, from payment orders to final settlement, were completed in real time, averaging just 80 seconds. The test involved 30 transactions across 17 different scenarios—such as corporate and interbank transfers—and was conducted in six currencies, including the Korean won, US dollar, and euro, with a total transaction value reaching approximately $995,000. The central bank reported that the platform operated stably throughout, despite being only partially connected to the existing banking infrastructure. Settlements using tokenized deposits were executed seamlessly, quickly, and transparently. An internal transfer of 20 million won (about $13,890) between NH NongHyup Bank and Shinhan Bank was also successfully processed via the Project Agora platform, which involved connecting to the Bank of Korea's CBDC test platform, Project Hangang. Additionally, KB Kookmin Bank and Japan's MUFG Bank tested cross-border payments using these deposit tokens—digital certificates issued by commercial banks within the pilot, not directly by the central bank. The Bank of Korea plans to continue testing payments with tokenized deposits. This follows last year's pledge by South Korean authorities to tighten regulations for won-based stablecoins, which will require approval from both the central bank and the Financial Services Commission.

cryptonews.ru1 h fa

Bank of Korea Reveals Results of Tokenized Deposit Testing

cryptonews.ru1 h fa

Head of Major Miner Estimates AI Profitability Ten Times Higher Than Mining

The CEO of Canadian mining company HIVE Digital Technologies, Frank Holmes, stated that the company is accelerating its development in artificial intelligence (AI) computing. HIVE, one of the world's largest public bitcoin miners controlling about 2% of the global hashrate, expects its revenue share from AI to grow from approximately 10% to over 50% this year. Holmes highlighted the significant difference in profitability, noting that ASIC miners generate around $0.12–0.14 per hour, while a single Nvidia H100 GPU can earn nearly $2 per hour. Even older GPUs yield about $1.4 per hour, roughly ten times the revenue from mining hardware. Major miners like Riot Platforms, Cipher Digital, MARA, and TeraWulf are mitigating losses by shifting from cryptocurrency mining to supporting AI computations in their data centers or combining both activities. For instance, MARA Holdings recently purchased a $600 million site for AI and mining data centers. The company's CEO had previously warned that without at least a 50% annual increase in Bitcoin's price, the current mining model would become unprofitable. With the estimated cost to mine one Bitcoin around $78,000 for summer 2026 and Bitcoin's price remaining below that level for months, some miners have begun shutting down equipment as rising costs and network difficulty squeeze margins.

cryptonews.ru1 h fa

Head of Major Miner Estimates AI Profitability Ten Times Higher Than Mining

cryptonews.ru1 h fa

NKTsBFR Disclosed Details of the Cryptocurrency Bill Preparation

The head of Ukraine's National Securities and Stock Market Commission (NКЦБФР), Alexey Semenyuk, disclosed that the draft law on virtual assets is approximately 90% complete, with the final text expected in August. However, the bill's parliamentary passage will follow later. Key agreed-upon provisions include establishing the NКЦБФР as the primary regulator, with a clearly defined role for the National Bank, and classifying virtual assets in line with the EU's MiCA regulation. Licensing rules for service providers, prudential requirements, and a special regime for wartime operations are also settled. Major unresolved issues remain, notably the taxation framework for cryptocurrency transactions and the legal status of virtual assets in criminal and enforcement proceedings. Semenyuk noted these areas, outside the commission's direct competence, are progressing the slowest. Consultations on the post-enactment transition period are ongoing. Work on the legislation has spanned several years. The bill passed its first reading in September 2025 but faced significant delays due to thousands of proposed amendments. Officials anticipate the finalized law could take effect from January 1, 2027.

cryptonews.ru1 h fa

NKTsBFR Disclosed Details of the Cryptocurrency Bill Preparation

cryptonews.ru1 h fa

How Could the Strengthening of the Japanese Yen Affect Bitcoin?

The Japanese yen recorded its largest daily gain against the US dollar after the USD/JPY pair reversed from a recent high near 164.00. This suggests movements in the yen can impact global financial conditions, including Bitcoin. On the daily chart, the USD/JPY reversal followed a multi-month rally. Intense selling erased several days of gains, pushing the pair below 160.00 before a recovery to around 160.59. Despite signs of demand at lower levels, the failed attempt to hold above recent highs indicates weakening bullish momentum. The yen strengthened by as much as 3%, pulling the dollar down to an intraday low of 158.34. Analysts note the move's scale and unusually high trading volumes resemble past intervention episodes. Market focus is now on the Bank of Japan's signals and interest rate outlook, with hawkish cues potentially supporting further yen strength. A stronger yen could create short-term selling pressure on Bitcoin, particularly if investors unwind carry trades funded by cheap yen borrowings. However, if sustained yen strength lowers Japanese government bond yields and improves global liquidity, it could eventually foster more favorable conditions for risk assets like Bitcoin. Bitcoin's price fell 2.5% to $62,500, which may reflect initial investor selling.

cryptonews.ru1 h fa

How Could the Strengthening of the Japanese Yen Affect Bitcoin?

cryptonews.ru1 h fa

Trading

Spot