SparkCat: Cryptocurrency-stealing malware on iOS and Android

In recent months, a new malware has begun to wreak havoc among mobile device users. It is called SparkCat, a malicious software capable of stealing sensitive information, especially password recovery phrases. cryptocurrencies, , accessing users' image galleries. Although its presence was initially detected on Android, it has now been confirmed that it is also affecting iOS, which has set off alarm bells in the technology community.

This malware, identified by the firm of ciberseguridad Kaspersky has proven to be particularly advanced in its information theft techniques, using Optical Character Recognition (OCR) technology to extract data from screenshots and other images stored on devices. In this article, we will explore in depth what SparkCat is, how it works, and what steps can be taken to protect yourself.

What is SparkCat and why is it dangerous?

SparkCat is a type of information-stealing malware (stealer) whose main objective is to extract confidential data from mobile devices, specifically crypto wallet recovery phrases. It works by analyzing images stored in the user's gallery, searching for texts that may contain private keys, wallet addresses or sensitive credentials.

This malware has managed to infiltrate applications that have been massively downloaded from both the Google Play Store as from the Apple App Store, which sets a worrying precedent, since until now no stealer with OCR recognition had been detected in the official Apple store.

How SparkCat Works

SparkCat's method of operation is sophisticated and highly automated. It is distributed through seemingly legitimate applications, such as chat tools, assistants Artificial Intelligence and cryptocurrency exchange applications. Once installed on the device, it follows a well-defined process:

• permit request: When the infected application is run, the malware requests access to the user's image gallery. In order not to arouse suspicion, this request appears to be justified within the normal operation of the application.
• Scanning images with OCR: Once it gains access, SparkCat scans all stored images for texts that may contain sensitive information, such as cryptocurrency recovery phrases.
• Data extraction and filtering: After identifying relevant images, the malware extracts the data and sends it to an external server controlled by the attackers.
• Theft of funds: With the captured information, cybercriminals can access victims' cryptocurrency wallets and empty their funds without the user noticing until it's too late.

Impact of SparkCat on affected devices

To date, it is estimated that SparkCat has managed to infiltrate at least 242.000 dispositivos, both on Android and iOS. This figure is particularly alarming because it indicates that, despite security controls by Google and Apple, malware managed to bypass protections and spread widely.

The effects of SparkCat are devastating for affected users, as the loss of recovery keys means the total loss of funds stored in cryptocurrencies. Unlike traditional bank accounts, where recovery mechanisms are in place, most crypto wallets do not offer alternatives if the recovery key is compromised.

SparkCat Protection Measures

Although SparkCat is an advanced malware, there are several steps users can take to minimize the risk of infection and protect their digital assets:

• Avoid storing sensitive information in the gallery: Do not save screenshots with crypto wallet recovery phrases or other important credentials.
• Review app permissions: Before granting access to the gallery, check if the application really needs that permission to function.
• Remove suspicious apps: If you have recently installed unknown apps, check if they appear in the lists of infected applications and remove them immediately.
• Use cold wallets: For added security, use wallets hardware that store your keys offline and are not vulnerable to this type of attack.
• Update system and applications: Always keep your operating system and applications updated to ensure they have the latest security measures.

The role of developers in security

App developers have a crucial responsibility in combating threats like SparkCat. Implementing good security practices can prevent their apps from being used as a distribution channel for malware.

• Securing code and SDKs: Continually review dependencies and avoid using SDKs whose security cannot be verified.
• Obfuscation and threat detection: Implement code obfuscation techniques and active malware detection within applications.
• Constant monitoring and audits: Conduct penetration testing and security audits on a regular basis.

The emergence of SparkCat has shown that even the most secure ecosystems, such as the App Store, can be vulnerable. This malware represents a serious risk for cryptocurrency users and has highlighted the importance of cybersecurity in the digital world. It is essential to be informed, take preventive measures and be cautious with the applications we install to avoid compromising our privacy. sensitive data.