Overview

• Kaspersky identified SparkKitty in ‘币coin’ on Apple’s App Store and ‘SOEX’ on Google Play before both apps were swiftly removed
• The malware exploits iOS photo-gallery and Android storage permissions to upload images and device metadata to remote servers
• Researchers link SparkKitty to the earlier SparkCat strain and note some variants use OCR to pinpoint and steal seed-phrase screenshots
• Google says Play Protect, enabled by default on Android devices, blocks the malicious SOEX app and similar threats
• Although apps have been pulled from official stores, the campaign—active since February 2024—continues through unofficial channels, risking crypto loss and potential extortion