Recent research by Kaspersky has uncovered a new mobile Trojan, SparkKitty, which successfully infiltrates applications in both the Apple and Google stores, putting cryptocurrency users' security at risk.
Overview of the SparkKitty Trojan
The SparkKitty Trojan targets the theft of screenshots of cryptocurrency wallet recovery phrases, marking an escalation in attacks on mobile devices. Active since early 2024, it embeds itself in legitimate-looking applications, such as cryptocurrency price tracking tools and modified versions of popular social media.
Data Harvesting Methods and Threats
SparkKitty employs a sophisticated multi-stage process for data collection. It requests access to the photo gallery, captures images, and creates databases that are sent to remote servers. The primary objective is to extract cryptocurrency phrases, putting users at risk of cybercriminal activity.
Industry Response and Security Recommendations
Following the discovery of SparkKitty, both Apple and Google initiated the removal of infected applications. Experts recommend that users avoid storing crypto phrases on mobile devices and switch to protection via hardware wallets. The discussion around the need for stricter security standards for cryptocurrency-related mobile applications is also gaining momentum.
The SparkKitty campaign highlights the necessity of raising awareness about mobile device security. Users must adapt their practices to protect their crypto assets from emerging threats.
