🔥🔥🔥 Crypto Catastrophe: SparkCat Malware Steals Your Digital Fortune! 🔥🔥🔥

by

Well, well, well, it seems like the digital world has a new villain in town! Meet SparkCat, a sneaky malware that’s been slinking around popular mobile apps, stealing cryptocurrency wallet private keys like a cat burglar in the night. And get this, it’s been downloaded over 200,000 times! 😱

Kaspersky, a cybersecurity firm, warned us about this pesky malware in a report on Feb. 4. SparkCat, a cunning thief that targets both Android and iOS users, spreads through malicious software development kits embedded in seemingly harmless apps. It’s like a wolf in sheep’s clothing, but with more zeros and ones. 🐺🐑

But how does SparkCat do it, you ask? Well, it uses optical character recognition, a technology that reads text from images, to scan through a victim’s photo gallery, hunting for crypto wallet recovery phrases hidden in screenshots or saved notes. It’s like a digital bloodhound, but instead of sniffing out criminals, it’s sniffing out your digital fortune. 🔍💰

And the worst part? This malware has been active since March 2024, and some of these infected apps, including food delivery and AI-powered messaging apps, were available on Google Play and the App Store. It’s like a digital Trojan horse, but instead of soldiers, it’s carrying malware. 🐴🦠

How does SparkCat work?

On Android, the malware is injected via a Java-based SDK called Spark, which disguises itself as an analytics module. When an infected app is launched, Spark retrieves an encrypted configuration file from a remote GitLab repository. It’s like a digital pickpocket, but instead of stealing your wallet, it’s stealing your private keys. 💼🔑

Once active, SparkCat uses Google ML Kit’s OCR tool to scan the device’s image gallery. It searches for specific keywords related to crypto wallet recovery phrases across multiple languages, including English, Chinese, Korean, Japanese, and several European languages. It’s like a digital Sherlock Holmes, but instead of solving crimes, it’s stealing your crypto. 🕵️‍♂️💰

The malware then uploads the image to an attacker-controlled server, either via Amazon cloud storage or a Rust-based protocol, which adds an extra layer of complexity in tracking its activity due to encrypted data transfers and non-standard communication methods. It’s like a digital magician, but instead of pulling rabbits out of hats, it’s pulling private keys out of your device. 🎩🐇

On iOS, SparkCat operates through a malicious framework embedded in the infected apps, disguised under names like GZIP, googleappsdk, or stat. This framework, written in Objective-C and obfuscated with HikariLLVM, integrates with Google ML Kit to extract text from images in the gallery. It’s like a digital chameleon, but instead of blending in with its surroundings, it’s blending in with your device. 🦎🖥️

To avoid raising suspicion, the iOS version only requests gallery access when users perform specific actions, such as opening a support chat. It’s like a digital pickpocket, but instead of stealing your wallet, it’s stealing your private keys. 💼🔑

Several users at risk

Kaspersky estimates that the malware has infected over 242,000 devices across Europe and Asia. While the exact origin remains unknown, embedded comments in the code and error messages suggest that the malware’s developers are fluent in Chinese. It’s like a digital

Read More

2025-02-05 11:04