According to Kaspersky, a Russian cybersecurity firm, several apps available in the Google Play Store and the Apple App Store contain components capable of scanning images that include cryptocurrency seed phrases.
Seed Phrases Stored in Screenshots at Risk, Kaspersky Warns
Kaspersky, a cybersecurity firm of Russian origin, has warned about a new threat that targets cryptocurrency holders with lax security practices. The crypto-stealing software, Sparkcat, has an embedded kit that scans the images on a user’s phone, seeking seeded phrases stored in the pictures.
Sparkcat uses optical character recognition (OCR) software, which allows the algorithm to read data directly from images and transform it into text. The model used for the task specifically searches for mnemonics, words that compose the seed phrases of each cryptocurrency, and facilitates the backup, archive, and recovery of private keys.
Kaspersky explained that the malware implemented obfuscation practices to hide its presence from security tools, making its detection complex. Also, the permissions required by these apps are similar to those required by normal apps, giving almost no tips on the presence of malicious software.
Chatai, one of the mentioned apps, masqueraded as an artificial intelligence (AI) prompt. It had this malware payload embedded and was available in app stores by late 2024. Several other food delivery service apps and AI chats are also infected.
Kaspersky identified 18 infected Android apps and 10 Ios apps, many still available in these stores. The security company found that these malicious apps had been downloaded over 242,000 times in these app stores, putting these users at risk of having their wallets drained.
The company recommended the immediate uninstallation of the apps involved before a patch is issued to contain and remove the scanning functionality of this software.
“Do not store screenshots with sensitive information in the gallery, including recovery phrases for access to cryptocurrency wallets. Passwords, confidential documents, and other sensitive data can be stored in special applications,” Kaspersky concluded.
While individuals were affected by this software, Kaspersky offered no numbers linked to these losses.