SparkKitty

visiting the website on an iPhone triggers a series of redirects, ultimately landing the user on a page that crudely mimics the App Store and prompts them to download an app.

The malware was distributed through unofficial sources as well as Google Play and App Store... In both the Android and iOS versions, the malicious payload was part of the app itself, not of a third-party SDK or framework. | The threat actor distributed apps containing a malicious SDK/framework... On iOS, the malicious payload is delivered as frameworks (primarily mimicking AFNetworking.framework or Alamofire.framework) or obfuscated libraries disguised as libswiftDarwin.dylib, or it can be embedded directly into the app itself.

Threat actors use fake Meta ads, AI-generated videos, and lookalike domains to trick victims into phishing sites and trojanized app downloads.

Delivery relies on two main paths: official store listings and sideloaded packages. Store versions raise trust and reach large audiences quickly, while sideloaded APKs and rooted-device modules extend persistence on Android through frameworks such as Xposed.

Distributed through malicious apps and social-engineering tactics, the malware harvests credentials, personal data, and device information while minimizing signs of compromise.

Threat actors use fake Meta ads, AI-generated videos, and lookalike domains to trick victims into phishing sites and trojanized app downloads.

T1546.008 — Accessibility Features (Privilege Escalation) ; T1546.008 — Accessibility Features (Persistence)

T1546.008 — Accessibility Features (Privilege Escalation) ; T1546.008 — Accessibility Features (Persistence)

In the case of the malicious TikTok mods, the attackers used an Enterprise profile... Once the profile is installed on a device, the certificate becomes trusted, allowing the app to run.

By abusing iOS provisioning profiles to install malware, attackers were able to steal recovery phrases from major hot wallets

application crypto nommée « coin » publiée sur l’ Apple App Store, dissimulant la charge malveillante dans des frameworks obfusqués

It retrieves the Base64-encoded value of the ccc key... decoded and then decrypted using AES-256 in ECB mode... The decrypted value is a list of URLs...

26 мошеннических приложений, маскировавшихся под MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken и Bitpie

To keep track of which photos have been stolen, it creates a local database.

It checks if the value of the ccool key in the app’s main Info.plist configuration file matches the string 77e1a4d360e17fdbc. If the two differ, the malicious payload will not proceed.

Many [malicious apps are] distributing the SparkKitty spyware, enabling data theft from compromised devices.

the malware harvests credentials, personal data, and device information while minimizing signs of compromise

убеждать их установить профили разработчика, через которые затем в обход официального магазина устанавливались троянизированные версии кошельков

the malware sends a GET request to the /api/getImageStatus endpoint, transmitting app details and the user’s UUID... the Trojan writes a hexadecimal number... an MD5 hash of a string containing the infected device’s IMEI, MAC address, and a random UUID.

On every launch, the app requested access to the user’s photo gallery... Next, the malware requests access to the user’s photo gallery.

The malware runs quietly in the background after users grant gallery permission, and it also collects device details that help attackers refine later campaigns.

the Trojan then checks the contents of a file named aray/cache/devices/.DEVICES on external storage.

It checks if the value of the ccool key in the app’s main Info.plist configuration file matches the string 77e1a4d360e17fdbc. If the two differ, the malicious payload will not proceed.

the malware harvests credentials, personal data, and device information while minimizing signs of compromise

Many [malicious apps are] distributing the SparkKitty spyware, enabling data theft from compromised devices.

After permission is granted, it watches the image folder and periodically runs OCR libraries against new and existing files.

It would then use an OCR model to select and exfiltrate images of interest... ML Kit searched for text blocks and then broke them down into lines. If at least three lines containing a word with a minimum of three letters were found, the Trojan would send the image to the attackers’ server.

T1530 — Data from Cloud Storage (Collection)

To do this, the malware sends a GET request to the /api/getImageStatus endpoint... Data transmission is performed directly... by making a PUT request to the /api/putImages endpoint.

The decrypted value is a list of URLs from which the malware fetches additional payloads, encrypted using the same method. This new ciphertext contains a set of C2 addresses used for exfiltrating stolen photos.

Extracted text, including seed phrases, passwords, and QR code data, travels silently to command-and-control infrastructure along with basic device metadata.