SparkKitty Targets Photo Albums to Hunt Crypto Seed Phrase

Cryptos: 21,330
Exchanges: 1,863
Market Cap: $3.28T 5.64%
24h Vol: $411,857,153,945 2.31%
Dominance: BTC: 64.0% ETH: 9.0%
Gas: 7 GWEI

Connect

Crypto News Exploits

SparkKitty Malware Targets Photo Galleries to Hunt Crypto Seed Phrase

Written by Aaron S.,

Editor-In-Chief

Last Updated: June 24, 2025

Key Takeaways

The SparkKitty malware hides in mobile applications and steals all photos to find crypto seed phrases;
The malware was found in apps, such as 币coin and SOEX, which were available on both iOS and Android app stores;
Most infections are in Asia, but the malware can spread globally with no region blocks.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now! 🔥

SparkKitty Malware Targets Photo Galleries to Hunt Crypto Seed Phrase

BITDEGREE IN YOUR SOCIAL FEED

A new type of malware, called SparkKitty, is being used to collect photos from mobile devices to find screenshots of cryptocurrency seed phrases.

The discovery was made by Kaspersky researchers Sergey Puzan and Dmitry Kalinin, who explained that SparkKitty is able to infect both iPhones and Android phones by hiding inside apps available on official app stores.

According to a June 23 report, the malware has been found in several apps, including one called 币coin on the Apple App Store and another named SOEX on Google Play.

How to Trade NFTs Safely? (Animated Explainer For Beginners)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The first claimed to be a crypto tracking tool, while the second combined messaging with exchange features. SOEX had been downloaded over 10,000 times before Kaspersky alerted Google, which then removed it from the store.

Once installed, SparkKitty copies all images from a device’s gallery without checking their contents. While the main goal seems to be finding wallet recovery phrases, the attackers could also get access to other private information stored in those pictures.

According to Kaspersky’s research, the malware mostly affects users in Southeast Asia and China. Many of the infected apps were written in Chinese and designed to appeal to users in that region.

However, the researchers noted that SparkKitty is capable of spreading to other parts of the world, as it does not include any regional limits in its design.

On June 9, Kaspersky reported that a hacker group known as Librarian Ghouls had taken control of hundreds of computers in Russia to secretly mine cryptocurrency. How? Read the full story.