Security of personal data dMobile devices face new challenges with the emergence of advanced threats which infiltrate seemingly legitimate programs.
One of the latest options identified by Kaspersky’s cybersecurity experts as SparkCat has demonstrated the ability to evade the controls of official stores and access sensitive information stored in iPhone and Android photo gallery. Early detection of this type of malware is key to preventing data theft, especially when it comes to digital wallets.
Interest in the topic is growing thanks to reports from cybersecurity experts warning of malware campaigns targeting users around the world. SparkCat in particular hides inside legitimate programs and uses sophisticated techniques to extract private information, such as cryptocurrency recovery phrasesfrom images stored on the device.
How to identify spyware
There are several indicators that can reveal the presence of spyware or malware on an Android phone:
1. Low performance and frequent crashes
- Mobile is slower to respond, apps take time to open or close, and crashes are common. This is usually due to hidden processes that are started by malicious software.
2. High battery and data consumption
- An unexpected increase in battery or mobile data usage may indicate that an infected app is sending information in the background.
3. Overheating
- The temperature of the device rises abnormally even during simple activities due to the intensive use of the CPU by the malware.
4. Unknown programs or suspicious permissions
- The appearance of programs not installed by the user, or programs that request additional permissions for no apparent reason, such as access to the camera, microphone, or photo gallery.
5. Configuration Changes
- Unexpected changes to the home screen, constant pop-up messages, or changed settings can be signs that there is malware running on the system.
SparkCat: Malware that steals gallery data
Researchers from a digital security company managed to identify a new one SparkCat option in apps available on App Store and Google Play. Malware hides in legitimate applications, including business messaging tools and food delivery services.
Once installed, it requests access to an image gallery and uses an optical character recognition (OCR) module to analyze photos for digital wallet recovery phrases.
On Android, SparkCat searches for Japanese, Korean and Chinese keywords, indicating a major target in the Asian market. On iOS, this option analyzes recovery code images in English, expanding coverage to other regions. When the malware finds relevant information, it sends it to cybercriminals.
The latest version of SparkCat includes advanced techniques such as code virtualization and the use of cross-platform programming languages that make detection and analysis more difficult. Cybersecurity reports indicate that the malicious code has already been removed from official storesbut the risk of downloading from web pages that mimic the App Store interface remains.
How to protect yourself and reduce risks
According to the Kaspersky team, the following recommendations can help prevent infection and protect personal data:
– Install a robust cyber security solution The tools detect and block malware on Android and prevent connections to malicious servers on iOS.
– Avoid saving screenshots with sensitive information Cryptocurrency wallet passphrases and other sensitive data should be stored in special password management programs, not in the gallery.
– Only download apps from official sources and check permissions Although official stores are not risk-free, it is advisable to avoid downloading programs from external sources and check the requested permissions.
– Update your operating system and applications Regular software updates help eliminate vulnerabilities and improve protection against the latest threats.
The use of malware that accesses the image gallery has increased with the popularity of digital wallets and the habit of storing sensitive information in photos. Moose Cybercriminals are improving their methods of evading security controls, so prevention and constant monitoring are essential to avoid disclosure of personal and financial data.
