New spyware SparkKitty steals your photos and screenshots

Cases of spyware scanning smartphone photo galleries have shown that storing pictures with passwords or crypto wallet seed phrases is dangerous. Experts warn that the new SparkKitty Trojan can steal screenshots and other images from iOS and Android devices.

Lifehacker writes about it.

Here's how spyware hunts for images

Kaspersky analysts discovered that SparkKitty spreads through fake apps in the Apple App Store, Google Play, and third-party repositories, including duplicate TikTok and fake crypto apps. Once installed on an iPhone, the program requests access to the photo gallery and monitors the appearance of new photos, immediately uploading them to the attacker's server. On Android devices, the trojan requires storage read access. It adds device identifiers and metadata to the uploaded files and uses Google ML Kit to recognize text in screenshots.

The researchers suggest that SparkKitty is a modified version of the previously discovered SparkCat focused on cryptocurrency theft. While the new sample "packs" any images from the gallery, cryptocurrency wallets are still likely to be the first target. The resulting confidential data can also be used for blackmail.

Experts advise against saving screenshots containing passwords or seed phrases in the gallery. Instead, logins should be stored in a password manager, and the seed phrase should be divided into pieces and stored offline. Before installing any application, study the developer's reputation and reviews. During installation, carefully check the requested permissions, especially if the program requests access to the photo gallery without an obvious reason.

As we wrote, hacking a Google account can have catastrophic consequences: attackers can access not only email, but also saved passwords, banking transactions, and photo archives.

Also, cybersecurity experts have identified the potential problem that could pose a threat to billions of devices around the world. The hidden command was found in the encoded Bluetooth chip that can be used by attackers.