Loading malware…
SparkCat is a cross-platform mobile infostealer targeting Android and iOS devices, with a primary focus on cryptocurrency users. It is notable for embedding malicious components inside otherwise legitimate-looking mobile applications distributed through both official app marketplaces and unofficial channels. On Android, SparkCat has been delivered as a malicious SDK within trojanized apps; on iOS, it has appeared as embedded malicious frameworks or libraries. Infected applications have included messaging, finance, exchange, food delivery, and other consumer-facing themes, enabling broad exposure.
The malware’s core function is theft of cryptocurrency wallet recovery material stored in device photo galleries. After obtaining access to photos or gallery content, SparkCat uses optical character recognition to scan stored images for wallet seed phrases and related sensitive text. It supports multilingual targeting and has been observed searching for mnemonic and recovery-phrase content across multiple languages, with reporting indicating particular attention to Asian users while also supporting broader geographic reach. SparkCat selectively exfiltrates images or extracted content that match attacker-defined keywords or filtering logic, along with device metadata, to attacker-controlled infrastructure.
SparkCat employs substantial obfuscation and custom communications to hinder analysis and detection. Reported variants have used encrypted configuration retrieval, custom protocol components implemented in Rust, and layered concealment of OCR and command-and-control functionality. Later Android variants reportedly added stronger obfuscation, including code virtualization and concealed Rust libraries, while newer iOS variants have used native OCR frameworks. The malware has also been associated with malicious apps that passed review and were published in Google Play and Apple’s App Store, making it one of the more significant examples of mobile stealer activity reaching official stores.
SparkCat has been active since at least March 2024 and has been linked by multiple researchers to Chinese-speaking operators based on technical artifacts and code characteristics, although public reporting has not established attribution to a named threat group with high confidence. It is also described as the predecessor or earlier form of the related SparkKitty activity. The campaign has targeted users in Asia, Europe, and other regions, with the highest risk falling on victims who store wallet recovery phrases as screenshots or photos on their devices.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
We cannot confirm with certainty whether the infection was a result of a supply chain attack or deliberate action by the developers.
The malware was distributed through unofficial sources as well as Google Play and App Store... In both the Android and iOS versions, the malicious payload was part of the app itself, not of a third-party SDK or framework. | The threat actor distributed apps containing a malicious SDK/framework... On iOS, the malicious payload is delivered as frameworks (primarily mimicking AFNetworking.framework or Alamofire.framework) or obfuscated libraries disguised as libswiftDarwin.dylib, or it can be embedded directly into the app itself.
It was originally obfuscated, so we statically deobfuscated it before analyzing.
It retrieves the Base64-encoded value of the ccc key... decoded and then decrypted using AES-256 in ECB mode... The decrypted value is a list of URLs...
Le cheval de Troie se déguise en application légitime pour scanner discrètement la galerie photos de l’utilisateur... Il se propage via des applications infectées en apparence anodines : messageries d’entreprise et applications de livraison de repas figurent parmi les vecteurs identifiés.
Once a configuration has been downloaded, Spark decrypts a payload from assets and executes it in a separate thread. It uses XOR with a 16-byte key for a cipher.
the handler requests access to the device’s image gallery. If the pw flag in the aforementioned object is equal to 1, the module will keep requesting access if denied.
The SDK then uploads device information to /api/e/d/u on the C2 server.
Обфусцированная вредоносная библиотека на Rust расшифровывалась с помощью виртуальной машины, созданной атакующими, по устройству похожей на Dalvik.
Some of these scanned users’ image galleries in search of crypto wallet access recovery phrases.
The reasoning behind the SDK’s request seems sound at first: users may attach images when contacting support.
the malware is flexible enough to steal not just these phrases but also other sensitive data from the gallery, such as messages or passwords that might have been captured in screenshots.
These parameters are used by processor classes that filter images by OCR-recognized words.
It would then use an OCR model to select and exfiltrate images of interest... ML Kit searched for text blocks and then broke them down into lines. If at least three lines containing a word with a minimum of three letters were found, the Trojan would send the image to the attackers’ server.
Spark uses POST requests to communicate with the “http” server.
The JSON is sent to the server with the help of the native libmodsvmp.so library via the unidentified protocol over TCP sockets.
103 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier stealer family described as the predecessor or direct evolutionary basis for SparkKitty.
Earlier stealer malware family described as the predecessor to SparkKitty, associated with similar OCR-based theft from mobile devices.
A crypto-stealing malware found in Android and iOS apps. On Android it used a heavily obfuscated Rust library decrypted via an attacker-created virtual machine; on iOS it used Apple's Vision framework for OCR.
Mobile trojan targeting cryptocurrency users by masquerading as legitimate apps, requesting access to photo galleries, using OCR to scan images for wallet recovery phrases, and exfiltrating relevant images to attackers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.