Kaspersky warns of SparkKitty Trojan on app stores

Cybersecurity firm Kaspersky has discovered a new Trojan spy called SparkKitty, which targets both iOS and Android devices. The malware has been found hidden in apps distributed through the App Store, Google Play, and scam websites, Kaspersky researchers said.

The Trojan was embedded in apps related to cryptocurrency and gambling, as well as in a trojanized version of TikTok. According to Kaspersky, the malware collects images from infected devices and sends them, along with device information, to attackers. The campaign appears to focus on stealing digital assets from users in Southeast Asia and China. Filipinos are also at risk, the company warned.

“In this malicious campaign, the attackers used one of them: special developer tools for distributing corporate business applications,” said Sergey Puzan, malware expert at Kaspersky. “In the infected version of TikTok, during authorization, the malware, in addition to stealing photos from the smartphone gallery, embedded links to a suspicious store in the person’s profile window.”

He added that the store accepted only cryptocurrency payments, raising further concerns about its purpose.

Kaspersky said the campaign may be connected to SparkCat, another Trojan discovered earlier on iOS that scans image galleries for crypto wallet recovery phrases. This marks the second time in a year that Kaspersky has found a Trojan stealer on the App Store.

The SparkKitty malware was disguised as apps like 币coin, a crypto-related service, and SOEX, a messenger with crypto exchange features. SOEX, available on Google Play, was downloaded more than 10,000 times.

Although the infected apps appeared to work as described, they secretly sent gallery photos to attackers, who could use the images to extract confidential information like crypto wallet keys. Kaspersky has notified Apple and Google about the malicious apps.

Get the latest before it trends. Follow Back End News on LinkedIn, Facebook, X, YouTube, and TikTok for updates and in-depth coverage across the tech and security landscape.