SparkKitty

visiting the website on an iPhone triggers a series of redirects, ultimately landing the user on a page that crudely mimics the App Store and prompts them to download an app.

The malware was distributed through unofficial sources as well as Google Play and App Store... In both the Android and iOS versions, the malicious payload was part of the app itself, not of a third-party SDK or framework. | The threat actor distributed apps containing a malicious SDK/framework... On iOS, the malicious payload is delivered as frameworks (primarily mimicking AFNetworking.framework or Alamofire.framework) or obfuscated libraries disguised as libswiftDarwin.dylib, or it can be embedded directly into the app itself.

we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets. Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distributing trojanized versions of legitimate wallets.

Later, we discovered other versions of this Trojan embedded in casino apps. These were loaded using the LSPosed framework, which is designed for app code hooking. Essentially, these Trojan versions acted as malicious Xposed modules. They would hook app entry points and execute code similar to the malware we described earlier.

In the case of the malicious TikTok mods, the attackers used an Enterprise profile... Once the profile is installed on a device, the certificate becomes trusted, allowing the app to run.

By abusing iOS provisioning profiles to install malware, attackers were able to steal recovery phrases from major hot wallets

obfuscated libraries disguised as libswiftDarwin.dylib... had initialization functions that were obfuscated with LLVM... The code uses custom names for classes, methods, and fields.

It retrieves the Base64-encoded value of the ccc key... decoded and then decrypted using AES-256 in ECB mode... The decrypted value is a list of URLs...

malicious payload is delivered as frameworks (primarily mimicking AFNetworking.framework or Alamofire.framework) or obfuscated libraries disguised as libswiftDarwin.dylib

To keep track of which photos have been stolen, it creates a local database.

It checks if the value of the ccool key in the app’s main Info.plist configuration file matches the string 77e1a4d360e17fdbc. If the two differ, the malicious payload will not proceed.

Tapping these opened WebView, revealing an online store named TikToki Mall... For Android users, the link downloaded an APK file that opened the scam platform via WebView.

This link kicks off a scheme leveraging provisioning profiles to install infected versions of crypto wallets onto the victim’s device.

the malware sends a GET request to the /api/getImageStatus endpoint, transmitting app details and the user’s UUID... the Trojan writes a hexadecimal number... an MD5 hash of a string containing the infected device’s IMEI, MAC address, and a random UUID.

On every launch, the app requested access to the user’s photo gallery... Next, the malware requests access to the user’s photo gallery.

the Trojan then checks the contents of a file named aray/cache/devices/.DEVICES on external storage.

It checks if the value of the ccool key in the app’s main Info.plist configuration file matches the string 77e1a4d360e17fdbc. If the two differ, the malicious payload will not proceed.

The malware exfiltrates any accessible photos that have not already been uploaded... If the gallery is modified while the app is running, the malware will attempt to access and upload the new images to the C2 server.

Tapping these opened WebView, revealing an online store named TikToki Mall... For Android users, the link downloaded an APK file that opened the scam platform via WebView.

It would then use an OCR model to select and exfiltrate images of interest... ML Kit searched for text blocks and then broke them down into lines. If at least three lines containing a word with a minimum of three letters were found, the Trojan would send the image to the attackers’ server.

To do this, the malware sends a GET request to the /api/getImageStatus endpoint... Data transmission is performed directly... by making a PUT request to the /api/putImages endpoint.

The decrypted value is a list of URLs from which the malware fetches additional payloads, encrypted using the same method. This new ciphertext contains a set of C2 addresses used for exfiltrating stolen photos.

the malware exfiltrates any accessible photos... by making a PUT request to the /api/putImages endpoint... the Trojan uploads images from the gallery, along with infected device info, to the command server via a PUT request to /api/putDataInfo.