New SparkCat Trojan Variant Targets iOS and Android to Steal Crypto Wallets

While most of us in Seattle are more concerned with the morning commute on I-5 or the latest drizzle over the Space Needle, a sophisticated digital threat has quietly made its way into the pockets of thousands of mobile users. The discovery of a new SparkCat Trojan variant—detected by Kaspersky—isn’t just another headline for the tech crowds in South Lake Union; it is a wake-up call for anyone in the Pacific Northwest who manages digital assets. This isn’t a simple phishing link sent via email. We are talking about malware that has successfully bypassed the security screenings of both the Apple App Store and Google Play Store, hiding inside apps that look entirely benign.

The Evolution of SparkCat: From Targeted Attacks to Global Reach

The SparkCat Trojan is not a new arrival, but its recent evolution is alarming. Originally documented by Kaspersky in February 2025, the malware was initially seen as a targeted operation, likely driven by a Chinese-speaking operator. Early versions focused heavily on users in Asia, the UAE, and parts of Europe, scanning for keywords in languages such as Chinese, Japanese, Korean, French, and Portuguese. However, the latest variant represents a significant shift in strategy. According to Kaspersky researcher Sergey Puzan, the iOS version of this Trojan now specifically scans for cryptocurrency wallet mnemonic phrases written in English.

This pivot to English-language targeting effectively removes the regional barriers that previously limited the malware’s impact. For a tech-centric hub like Seattle, where a high density of software engineers and crypto-investors reside, this makes the local population a prime target. The malware doesn’t just steal data; it uses a sophisticated optical character recognition (OCR) module. Once it gains access to your photo gallery, it uses machine learning to “read” your screenshots, searching specifically for those recovery phrases you might have saved for safekeeping. If you have a screenshot of your seed phrase sitting in your camera roll, SparkCat can discover it and exfiltrate it to an attacker-controlled server.

Technical Sophistication and Stealth Mechanisms

What makes SparkCat particularly dangerous is how it disguises itself. It doesn’t arrive as a suspicious file from an unknown source; instead, it embeds itself within legitimate-looking applications. Kaspersky identified the malware within enterprise messengers, AI assistants, and food delivery services. In one specific instance, a food delivery app called ComeCome was found to be infected on both iOS and Android. On Google Play alone, these infected apps were downloaded over 242,000 times before detection.

The Android version of SparkCat has become even more elusive. To avoid detection by security researchers and automated scanners, the latest iteration employs several layers of obfuscation. This includes code virtualization and the employ of cross-platform programming languages, designed specifically to sidestep analysis efforts. By the time a user realizes their gallery has been scanned, the recovery phrases are already gone. This level of technical agility suggests that the threat actors are actively evolving their toolkit to stay ahead of platform security updates from Apple and Google.

The Ripple Effect on Digital Asset Security

The emergence of OCR-based malware changes the fundamental rules of “safe” storage. For years, the common advice was to keep recovery phrases offline. While some users took this to mean “don’t put them in a text file,” many mistakenly believed that a screenshot or a photo of a handwritten note stored in a password-protected phone was sufficient. SparkCat proves that once a malicious app is granted permission to access the gallery, the “visual” nature of the data is no longer a barrier.

This trend highlights a critical vulnerability in the mobile ecosystem. Even the most stringent app review processes can be bypassed. When a Trojan like SparkCat successfully enters the App Store, it leverages the inherent trust users have in official platforms. This breach of trust can lead to devastating financial losses, as cryptocurrency recovery phrases are the “master keys” to a wallet; once stolen, the assets are typically gone forever with no possibility of reversal through a central authority like the Federal Trade Commission or a traditional banking ombudsman.

Mitigating the Risk in a Connected City

To protect against this specific threat, users must move beyond basic app installations. It is no longer enough to trust an app simply because it is available on an official store. The first line of defense is the principle of least privilege: never grant an app access to your entire photo library if it doesn’t absolutely need it. In the case of SparkCat, the malware requests access to view photos in specific scenarios to trigger its OCR scanning. Being skeptical of these requests—especially from apps like messengers or delivery services—is essential.

the shift toward English-language targeting means that the risk is now global. Whether you are working from a coffee shop in Capitol Hill or managing a portfolio from a high-rise in downtown Seattle, the vulnerability remains the same. The only foolproof way to protect a recovery phrase is to ensure it never exists as a digital image on a connected device. Physical backups, such as steel plates or offline paper copies stored in secure locations, remain the gold standard for asset protection.

Local Resource Guide for Seattle Residents

Given my background in analyzing complex digital threats and their local impacts, I know that discovering a potential breach can be overwhelming. If you suspect your device has been compromised or if you’ve accidentally granted gallery permissions to a suspicious app in the Seattle area, you shouldn’t attempt to fix this with a generic online tutorial. You need specialized, local expertise to ensure your remaining assets are secure.

Depending on your situation, here are the three types of local professionals you should seek out:

Boutique Digital Forensics Specialists

Look for firms that specialize in mobile device forensics rather than general IT support. You need a professional who can perform a “deep dive” into your device’s logs to identify if unauthorized data exfiltration has occurred. Ensure they have experience with both iOS and Android obfuscation techniques and can provide a certified report of the breach.

Certified Cybersecurity Consultants (CISSP/CISM)

If you manage significant crypto-assets, you need a consultant to aid you implement a “Cold Storage” strategy. Look for experts who can audit your digital hygiene and help you migrate assets to hardware wallets. The criteria here should be professional certification and a proven track record of securing high-net-worth digital portfolios.

Privacy-Focused Legal Counsel

In the event of a theft, you may need a legal professional specializing in digital assets and cybercrime. Look for attorneys who understand the intersection of blockchain technology and Washington state law. They can help you navigate the process of reporting the crime to the FBI’s Internet Crime Complaint Center (IC3) and other relevant authorities.

Ready to find trusted professionals? Browse our complete directory of top-rated cybersecurity experts in the seattle area today.