SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App Store and Google Play — Threadlinqs Intelligence
As of 2026-07-27, SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App Store and Google Play is a high-severity malware threat attributed to Unattributed (assessed Chinese-speaking, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 58 indicators of compromise.
Threat ID: TL-2026-1717 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unattributed (assessed Chinese-speaking · FINANCIAL
SparkKitty is a cross-platform mobile stealer distributed via the Apple App Store, Google Play, and third-party/sideloaded APK sites, hidden inside trojanized apps -- including the iOS crypto-wallet
SparkKitty is a cross-platform (iOS + Android) mobile stealer, first publicly disclosed by Kaspersky/Securelist on 2025-06-23, that has been active since at least February 2024, primarily against users in China and Southeast Asia. Unlike its assessed predecessor SparkCat -- which selectively OCR-filtered gallery images for wallet-recovery keywords using Google ML Kit -- some SparkKitty variants indiscriminately exfiltrate the entire photo gallery, while others retain the ML Kit OCR text-filtering approach to prioritize images containing recoverable text (seed phrases, recovery words, 2FA backup codes, exchange screenshots).
Distribution is multi-vector and abuses both official and unofficial channels. On iOS, the malware reached the App Store hidden inside "币coin," a fake cryptocurrency portfolio/tracker app, and was also distributed outside App Store review entirely via an abused Apple Developer enterprise/ad-hoc provisioning profile (certificate EHQ3N2D5WH, issued to "SINOPEC SABIC Tianjin Petrochemical Co. Ltd.," profile UUID 55b65f87-9102-4cb9-934a-342dd2be8e25, App ID com.ss-tpc.rd.rdcUniApp) bundled with a trojanized TikTok clone that requests photo-library access on every launch; attackers hosted the app on third-party sites that redirect iPhone users to pages mimicking the official App Store, requiring victims to manually trust the provisioning profile. On Android, the malware reached Google Play inside "SOEX," a messaging app with crypto-exchange features (10,000+ installs before takedown), and separately spreads through third-party APK distribution sites, trojanized TikTok mods, gambling/casino and adult-content apps, and LSPosed/Xposed modules that hook into app processes on rooted devices. A WebView-based scam commerce layer ("TikToki Mall") and YouTube-promoted Ponzi-style schemes further funnel victims toward malicious PWA/APK download pages.
Technically, SparkKitty masquerades its payload inside legitimate-looking components: on iOS, fake or trojanized frameworks (AFNetworking.framework, Alamofire.framework) and obfuscated dylibs (libswiftDarwin.dylib, wc.dylib, a modified libcrypto.dylib) execute via the Objective-C `+load` class method (observed entry selector `+[AFImageDownloader load]`), retrieving an AES-256 (ECB mode) encrypted configuration from an Info.plist key ("ccc") or a UserDefaults fallback ("com.tt.cf"). Execution is gated by a guardrail check: the payload validates that the Info.plist "ccool" key equals a fixed string ("77e1a4d360e17fdbc"); if the value differs, the payload does not proceed -- a config-value keying technique consistent with anti-analysis/anti-detonation design. On Android, Java/Kotlin payloads are embedded directly or injected via Xposed/LSPosed hooks into app entry-point Activities, and persist a device-identifier record at `aray/cache/devices/.DEVICES`. Both platforms compute a device identifier (MD5 of IMEI + MAC address + a random UUID on Android) and exfiltrate images via multipart form-data PUT requests to attacker C2 endpoints (`/api/putImages` on iOS, `/api/putDataInfo` on Android), preceded by heartbeat/status checks (`/api/getStatus`, `/api/getImageStatus`, `/api/anheartbeat`) that gate whether upload is permitted based on a `code`/`status` field in the JSON response. iOS traffic spoofs a TikTok User-Agent ("TikTok/31.4.0 (iPhone; iOS 14.8; Scale/3.00)") to blend in with legitimate app traffic. The Android/Kotlin module additionally probes multiple candidate C2 hosts and times each response, committing to whichever host answers fastest. C2 address lists are distributed and rotated via encrypted configuration files hosted on Aliyun OSS buckets (multiple regions: Beijing, Shenzhen, Shanghai), a Gitee repository (bbffipa/data-group), AWS S3, and UFile cloud storage -- allowing operators to update infrastructure without republishing the app binary. Independent researchers noted SparkKitty includes Frida-resistant anti-analysis checks intended to defeat dynamic instrumenta
Target sectors: cryptocurrency, financial services, consumer general public, gambling, social media
Target regions: china, Southeast Asia, Global (secondary exposure)
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 58 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1475, T1476, T1660, T1474, T1624, T1444, T1406, T1406, T1627, T1628