Accessibility links

Facebook   X   LinkedIn   Email

New Malware Sparkles Up Your Android and iOS

By: Jim Stickley and Tina Davis
August 12, 2025

Who can you trust these days? Sadly, it’s getting more and more difficult to be sure. However, there are plenty of trustworthy cybersecurity researchers out there, such as those at Kaspersky. They found a mobile trojan just hanging out in the official app stores for the most popular smartphones just waiting to steal all of your photos. And it’s been out there hunting since February of 2024.

What is SparkKitty & what devices does it target

SparkKitty is a mobile trojan that targets both Android and iOS devices. It’s a follow-up to Kaspersky’s earlier warning about SparkCat spyware. 

How it infects devices

There are two places where SparkKitty can be found lurking. Official app stores is one such location. On Android, it snuck into a messaging app called SOEX (with crypto features) and was downloaded over 10,000 times from Google Play. On iOS, it hid in an app called ?coin on the App Store.

The second way they can sneak in is via unofficial sources. These are spread via modded TikTok clones, fake gambling, adultgame apps, and scam sites. On iOS, infection occurs when the user sideloads apps; i.e. they download them via sources that are not the official stores. On Android, it's embedded directly in Java/Kotlin apps, some using malicious Xposed modules.

What it does once installed

As mentioned previously, it can steal your photos. It can also:

  • Request photo storage permissions.
  • Automatically upload existing and newly added images to a Command and Control (C2) server.
  • Hunt for crypto wallet seed phrase screenshots using OCR, but also grab all personal photos—raising risks of extortion.

How to avoid SparkKitty

  • Only install trusted apps, avoid unknown or low rated apps and review external sources.
  • Never sideload apps or use enterprise profiles from unofficial websites.
  • Limit app permissions: Be skeptical of photo access requests. Ask yourself if the app really needs it?
  • On Android, enable Google Play Protect and consider reputable antivirus tools. Keep those AV tools updated.
  • On iOS, be mindful of provisioning profiles and avoid apps requiring gallery access.
  • Avoid screenshots of seed phrases for cryptocurrency—store recovery phrases offline (on paper, in a secure place).

While the app has been removed from the GooglePlay Store and the developer banned from adding apps, Apple had not removed it as of writing. Though the official stores are still the safest places to get your apps, SparkKitty shows that even official app stores aren’t infallible.



Is Sideloading Worth The Risk Of Downloading Malware?

Your Security

Is Sideloading Worth The Risk Of Downloading Malware?

It’s been well-known that sideloading apps is a risky proposition. Just ask the 20 million Aptoide users who recently learned their personally identifiable information (PII) was posted online by a hacker. Aptoide, a popular third-party app “discovery platform” had its database hacked earlier this month. The cybercriminal behind the hack claims that in addition to the 20 million exposed data files, there’s an additional 19 million files in their possession. Whether that’s true or not remains a mystery for now, but the Aptoide incident shows (in a huge way) why app sideloading is risky at best and is not recommended by security professionals. READ FULL STORY
Slow Browser? It May Have Been Hijacked By Malware

Your Security

Slow Browser? It May Have Been Hijacked By Malware

Before calling your internet provider to complain about a slow browser think about this:  It’s no secret malware loves to hide in all kinds of things like adware, spyware, scareware, and fake browser updates. Finding your browser is not only slow, but also acting strangely is a sign something isn’t quite right. If after going through the internet provider's standard toolbox for troubleshooting doesn't help, it’s time to think about malware. READ FULL STORY
Attackers Target Neglected Websites to Go Phishing

Scams & Phishing

Attackers Target Neglected Websites to Go Phishing

According to a recent study by Kaspersky, there is a growing trend of attackers focusing on abandoned and minimally maintained websites for the purpose of hosting very legitimate-looking phishing pages. In fact, the research revealed a significant volume of compromised websites. Between mid-May and the end of July, it identified 22,400 distinct WordPress websites that had been compromised by threat actors to serve as platforms for hosting phishing pages. READ FULL STORY
Keeping Your Bank Account And Credit Cyber-Smart

Education

Keeping Your Bank Account And Credit Cyber-Smart

Financial institutions and hacking go hand-in-hand. Hacking banks and their account holders is the most direct cash infusion a hacker can get…and they know it. According to Kaspersky Lab, attacks on ATMs alone hit an all-time high in 2017 with malware-as-a-service (MAAS) opportunities. With this service, even hacking “hacks” who have no cybercrime experience can watch an instructional “how to” video on how to target an ATM successfully. Guarding our finances with common sense protection is something we all need to do. READ FULL STORY
Carbanak Is Back! Ransomware Group Reinvents Itself

Corporate Security

Carbanak Is Back! Ransomware Group Reinvents Itself

Since the arrest of Carbanak's leader five years ago, the notorious ransomware group is back with a vengeance. The Carbanak ransomware syndicate gained notoriety as a highly effective cybercrime ring targeting financial and banking institutions worldwide. And now, the group has reinvented its method of attacks to reemerge as yet another force to be reckoned with. The group recently shifted their ransomware attacks from financial targets to posing as business software like HubSpot and Xero on compromised websites. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.