SparkKitty is a cross-platform (iOS + Android) mobile stealer, first publicly disclosed by Kaspersky/Securelist on 2025-06-23, that has been active since at least February 2024, primarily against users in China and Southeast Asia. Unlike its assessed predecessor SparkCat -- which selectively OCR-filtered gallery images for wallet-recovery keywords using Google ML Kit -- some SparkKitty variants indiscriminately exfiltrate the entire photo gallery, while others retain the ML Kit OCR text-filtering approach to prioritize images containing recoverable text (seed phrases, recovery words, 2FA backup codes, exchange screenshots).

Distribution is multi-vector and abuses both official and unofficial channels. On iOS, the malware reached the App Store hidden inside "币coin," a fake cryptocurrency portfolio/tracker app, and was also distributed outside App Store review entirely via an abused Apple Developer enterprise/ad-hoc provisioning profile (certificate EHQ3N2D5WH, issued to "SINOPEC SABIC Tianjin Petrochemical Co. Ltd.," profile UUID 55b65f87-9102-4cb9-934a-342dd2be8e25, App ID com.ss-tpc.rd.rdcUniApp) bundled with a trojanized TikTok clone that requests photo-library access on every launch; attackers hosted the app on third-party sites that redirect iPhone users to pages mimicking the official App Store, requiring victims to manually trust the provisioning profile. On Android, the malware reached Google Play inside "SOEX," a messaging app with crypto-exchange features (10,000+ installs before takedown), and separately spreads through third-party APK distribution sites, trojanized TikTok mods, gambling/casino and adult-content apps, and LSPosed/Xposed modules that hook into app processes on rooted devices. A WebView-based scam commerce layer ("TikToki Mall") and YouTube-promoted Ponzi-style schemes further funnel victims toward malicious PWA/APK download pages.

Technically, SparkKitty masquerades its payload inside legitimate-looking components: on iOS, fake or trojanized frameworks (AFNetworking.framework, Alamofire.framework) and obfuscated dylibs (libswiftDarwin.dylib, wc.dylib, a modified libcrypto.dylib) execute via the Objective-C `+load` class method (observed entry selector `+[AFImageDownloader load]`), retrieving an AES-256 (ECB mode) encrypted configuration from an Info.plist key ("ccc") or a UserDefaults fallback ("com.tt.cf"). Execution is gated by a guardrail check: the payload validates that the Info.plist "ccool" key equals a fixed string ("77e1a4d360e17fdbc"); if the value differs, the payload does not proceed -- a config-value keying technique consistent with anti-analysis/anti-detonation design. On Android, Java/Kotlin payloads are embedded directly or injected via Xposed/LSPosed hooks into app entry-point Activities, and persist a device-identifier record at `aray/cache/devices/.DEVICES`. Both platforms compute a device identifier (MD5 of IMEI + MAC address + a random UUID on Android) and exfiltrate images via multipart form-data PUT requests to attacker C2 endpoints (`/api/putImages` on iOS, `/api/putDataInfo` on Android), preceded by heartbeat/status checks (`/api/getStatus`, `/api/getImageStatus`, `/api/anheartbeat`) that gate whether upload is permitted based on a `code`/`status` field in the JSON response. iOS traffic spoofs a TikTok User-Agent ("TikTok/31.4.0 (iPhone; iOS 14.8; Scale/3.00)") to blend in with legitimate app traffic. The Android/Kotlin module additionally probes multiple candidate C2 hosts and times each response, committing to whichever host answers fastest. C2 address lists are distributed and rotated via encrypted configuration files hosted on Aliyun OSS buckets (multiple regions: Beijing, Shenzhen, Shanghai), a Gitee repository (bbffipa/data-group), AWS S3, and UFile cloud storage -- allowing operators to update infrastructure without republishing the app binary. Independent researchers noted SparkKitty includes Frida-resistant anti-analysis checks intended to defeat dynamic instrumentation, which were subsequently bypassed via Frida hooking during analysis.

Kaspersky assesses SparkKitty as the successor/"little sibling" to SparkCat (Securelist, disclosed January 2025), the first documented OCR-based crypto-stealer trojan to reach the Apple App Store. SparkCat itself initialized through an SDK component named "Spark" (disguised as an analytics SDK, package `com.spark.stat`) registered in the Android Application subclass's `onCreate` method, downloading base64-encoded, AES-128-CBC-encrypted JSON configuration from GitLab-hosted URLs; a native Rust library (`libmodsvmp.so`) masquerading as an Android code obfuscator implemented a secondary custom TCP C2 protocol using AES-GCM-SIV encryption, ZSTD compression, and RSA key exchange, selectable via a `tfm` configuration flag alongside the primary AES-256-CBC/AES-128-CBC HTTP channel. SparkCat hijacked a legitimate third-party customer-support library (Easemob HelpDesk SDK) to request photo-gallery access under a support-chat pretext, then ran an ML Kit OCR routine that scanned images for wallet-recovery-phrase keywords and dictionary terms across nine languages (Chinese, Japanese, Korean, English, Czech, French, Italian, Polish, Portuguese), exfiltrating matches -- plus device metadata, image hashes, and recognized keywords -- to an AWS S3 bucket and a `/api/e/img/rekognition` endpoint. The two campaigns share overlapping infected Android application sets (including shared package/bundle names such as `com.websea.exchange` across both platforms), identical framework construction methodology, matching iOS debug-symbol file paths (developer paths `/Users/qiongwu/` and `/Users/quiwengjing/`), the same cryptocurrency-theft objective via OCR/ML Kit, and comparable SDK-embedding and C2-configuration patterns, though Kaspersky found insufficient evidence to attribute either campaign to a named group -- Chinese-language code strings and comments, developer-path artifacts, and regional app targeting (China, Southeast Asia) point to a Chinese-speaking, financially motivated operator rather than a nation-state actor. SparkCat was first identified when researchers statically deobfuscated the Google Play food-delivery app "ComeCome" (`com.bintiger.mall.android`, 242,000+ downloads before removal) and discovered its suspicious "Spark" SDK initialization. Following SparkKitty's disclosure, Apple removed 币coin from the App Store (2025-06-25) and Google removed SOEX from Google Play and banned the developer account; the underlying campaign, distribution infrastructure, and app-repackaging technique remain active and continue to surface in new samples and trojanized apps.