Hackers Steal Crypto Wallet Seed Phrases from Image Galleries
A new type of malware called SparkKitty is using optical character recognition (OCR) to steal cryptocurrency wallet seed phrases directly from photos and screenshots in a device's gallery, bypassing traditional keylogging defenses. Once installed from malicious apps posing as legitimate crypto services on the Apple App Store and Google Play, it requests photo access, scans images for confidential data like passwords and seeds, and sends it to hackers' servers. Control of a seed phrase gives attackers complete access to drain the wallet. Initially detected as SparkCat, the evolved SparkKitty was found in the iOS app 币coin (hiding in obfuscated code) and the Android app SOEX (downloaded over 10,000 times). This method allows theft even when sensitive data is never typed or copied. The report comes alongside news of other attacks, like a method to hijack Telegram Desktop sessions bypassing 2FA.
cryptonews.ruIeri 13:26
