Kaspersky researchers disclosed SparkKitty in June 2026, with Check Point publishing analysis on July 27 that amplified and contextualized Kaspersky's findings. The malware infected at least two apps distributed through official channels: a crypto rate tracker called 币coin on Apple's App Store, and a messaging app with crypto-exchange features called SOEX on Google Play. SOEX had accumulated more than 10,000 installs before Google removed it and banned the developer. Apple also removed 币coin following disclosure. Neither platform's default protections caught the malware before it reached users.

SparkKitty works by requesting photo gallery access, then uploading every image on the device to attacker-controlled servers via standard HTTP PUT requests. The images are processed after the fact using optical character recognition (OCR), a technology that reads text from pictures, to identify cryptocurrency seed phrases. A seed phrase is a sequence of 12 to 24 words generated during wallet setup that provides complete, irrecoverable access to all funds in that wallet. Anyone who obtains it can drain the wallet within minutes, from any device, with no recourse for the victim. Security researchers have warned for years against storing seed phrases as screenshots, but the practice remains common, especially among newer mobile users.

"After the apps were installed, they functioned as promised in their description," said Dmitry Kalinin, a malware expert at Kaspersky. "But at the same time, photos from the smartphone gallery were sent to the attackers." Kalinin and colleague Sergey Puzan described the campaign as sustained and dangerous despite relying on straightforward methods. "While not technically or conceptually complex, this campaign has been ongoing since at least the beginning of 2024 and poses a significant threat to users," they wrote. On Android, the malware uses Google's own ML Kit library to handle the OCR processing. On iOS, it hides inside fake versions of legitimate networking frameworks, including AFNetworking and Alamofire.

Official app stores were not the only distribution channel. Kaspersky found SparkKitty embedded in fake TikTok clones, casino apps, adult-themed games, and counterfeit websites designed to look like legitimate platforms. Puzan noted that "one of the vectors for the Trojan's distribution turned out to be fake websites where the attackers tried to infect the victims' iPhones." SparkKitty encrypts its configuration using AES-256 in ECB mode with hardcoded keys, a relatively weak implementation, and some Android variants specifically target rooted devices through a framework called Xposed, which allows deeper system access. The campaign has been running for roughly 30 months without its underlying distribution infrastructure being dismantled.

SparkKitty is not an isolated incident. It belongs to a family that began with SparkCat, which Kaspersky documented in February 2025 as the first iOS malware ever confirmed to contain an OCR module. A new SparkCat variant appeared on both the App Store and Google Play as recently as April 2026, two months before the SparkKitty disclosure, indicating that the same threat actors have been iterating rapidly and bypassing app store reviews repeatedly.

The regional exposure is largest in South Asia and Africa, where mobile-first crypto adoption is highest. India ranks first on the Chainalysis 2025 Global Crypto Adoption Index, ahead of the United States. Pakistan has 18.2 million crypto users, a figure that grew by 5.4 million in a single year. Bangladesh has 3.1 million verified holders, primarily using stablecoins. In these markets, a smartphone is often the only device a user owns, which means seed phrases are typically generated, stored, and managed entirely on the same phone that SparkKitty targets. Wallet developers serving these regions have a practical reason to add in-app warnings against screenshotting seed phrases during onboarding.

Africa compounds the exposure with a documented mobile fraud crisis. Kenya recorded 4.6 billion cyber threats in the second quarter of 2025 alone, a 202% increase over the prior quarter. Nigeria lost roughly $32 million to fraud in 2024. An Interpol operation targeting online scams across Africa in late 2025 and early 2026 linked suspects to more than $45 million in total losses attributed to the scheme, while separately recovering $4.3 million. Africa's crypto adoption is heavily remittance-driven, meaning the users most at risk are often sending money to family members across borders, with no institutional safety net if a wallet is emptied. It is worth noting that Africa's overall crypto fraud rate has dropped 28% as markets mature; mobile-first users nonetheless remain disproportionately exposed, and the threat is concentrated among that specific segment rather than evenly distributed across the continent. That concentration is reflected directly in the malware family's documented reach: the April 2026 SparkCat variant was specifically observed in apps used in Zimbabwe and the UAE, providing concrete evidence linking SparkKitty's immediate predecessor to African exposure.

Kaspersky's researchers recommend that users never store a seed phrase as a screenshot or image file of any kind. Physical paper or a metal backup stored offline remains the standard recommendation. Users who have granted photo access to unfamiliar apps should treat that wallet as compromised and migrate funds to a new wallet immediately. For significant holdings, hardware wallets that generate and store seed phrases without the phrase ever appearing on a connected phone remain the most reliable option. App store review caught neither SparkCat nor SparkKitty before distribution, and at least three variants of this malware family have now reached users through official channels. Kaspersky's own documentation of three distinct variants emerging within roughly 18 months provides a clear basis for concern that the threat actors have not stopped iterating.