SparkKitty infiltrates phones disguised as encryption tools and chat apps, then uses OCR to scan wallet recovery phrases in photo albums
SparkKitty targets recovery phrases in mobile photo albums.
SparkKitty infiltrates phones disguised as encryption tools and chat applications, then uses OCR to scan wallet recovery phrases in photo albums.
Research shows it uploads identified recovery phrases, passwords, and QR code data to attackers, affecting both iPhone and Android.
The core of this type of attack is not "hacking into wallets," but directly stealing seed phrases that can take over accounts; once the seed phrase is leaked, control of the wallet is effectively lost.
The most affected are those who screenshot or photograph their recovery phrases, especially users who install apps from third-party stores and grant photo album permissions.
Source: Public Information
ABAB AI Insight
SparkKitty is not traditional key theft; it turns "human habits" into attack surfaces. It exploits users' practices of photographing or screenshotting recovery phrases, directly searching for 12-word recovery phrases in photo albums, shifting the attack chain from input methods and clipboards to the often-overlooked photo library.
In terms of capital pathways, this malware primarily targets high-value, low-defense on-chain users, particularly retail investors and small teams that store hot wallet recovery phrases on their phones. It does not rely on large-scale brute force but instead filters for individuals holding directly manageable assets, yielding returns far exceeding those of ordinary Trojans once a target is hit.
Historically, mobile asset theft has evolved from "stealing private keys" to "stealing usage scenarios." The difference this time is that attackers are no longer just focused on browser extensions or clipboards but are now targeting photo albums, OCR, and third-party application ecosystems, indicating that mobile devices have become the first line of defense for on-chain asset security.
Essentially, this is a technological replacement, replacing old credential theft methods. The competition will no longer just be about wallet security but about who can move "backup behaviors" out of risk sooner.
ABAB News · Cognitive Laws
The most dangerous backups are often the most convenient ones.
After the upgrade in theft, it is human nature that is exploited first, not technology.
True cold wallets first cool down backup habits.