# SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App Store and Google Play

> SparkKitty is a cross-platform mobile stealer distributed via the Apple App Store, Google Play, and third-party/sideloaded APK sites, hidden inside trojanized apps -- including the iOS crypto-wallet app "币coin" and the Android messaging/crypto-exchange app "SOEX" (10,000+ installs) -- that uploads device photo-gallery images (in some variants filtered via Google ML Kit OCR) to attacker C2 infrastructure to harvest cryptocurrency wallet seed phrases and recovery codes. It is Kaspersky-assessed as the successor to the SparkCat trojan (Securelist, January 2025), reusing its OCR-based theft technique and sharing infected-app overlap.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1717
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sparkkitty-ocr-seed-phrase-stealer-tl-2026-1717.webp?v=1d3ffe46 (Threadlinqs threat intel: SparkKitty OCR Photo Stealer: Detection & IOCs (TL-2026-1717) — High severity, 58 IOCs, 9 detection rules.)
- **ID:** TL-2026-1717
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 58 (3 shown free below)

## Description

SparkKitty is a cross-platform (iOS + Android) mobile stealer, first publicly disclosed by Kaspersky/Securelist on 2025-06-23, that has been active since at least February 2024, primarily against users in China and Southeast Asia. Unlike its assessed predecessor SparkCat -- which selectively OCR-filtered gallery images for wallet-recovery keywords using Google ML Kit -- some SparkKitty variants indiscriminately exfiltrate the entire photo gallery, while others retain the ML Kit OCR text-filtering approach to prioritize images containing recoverable text (seed phrases, recovery words, 2FA backup codes, exchange screenshots).

Distribution is multi-vector and abuses both official and unofficial channels. On iOS, the malware reached the App Store hidden inside "币coin," a fake cryptocurrency portfolio/tracker app, and was also distributed outside App Store review entirely via an abused Apple Developer enterprise/ad-hoc provisioning profile (certificate EHQ3N2D5WH, issued to "SINOPEC SABIC Tianjin Petrochemical Co. Ltd.," profile UUID 55b65f87-9102-4cb9-934a-342dd2be8e25, App ID com.ss-tpc.rd.rdcUniApp) bundled with a trojanized TikTok clone that requests photo-library access on every launch; attackers hosted the app on third-party sites that redirect iPhone users to pages mimicking the official App Store, requiring victims to manually trust the provisioning profile. On Android, the malware reached Google Play inside "SOEX," a messaging app with crypto-exchange features (10,000+ installs before takedown), and separately spreads through third-party APK distribution sites, trojanized TikTok mods, gambling/casino and adult-content apps, and LSPosed/Xposed modules that hook into app processes on rooted devices. A WebView-based scam commerce layer ("TikToki Mall") and YouTube-promoted Ponzi-style schemes further funnel victims toward malicious PWA/APK download pages.

Technically, SparkKitty masquerades its payload inside legitimate-looking components: on iOS, fake or trojanized frameworks (AFNetworking.framework, Alamofire.framework) and obfuscated dylibs (libswiftDarwin.dylib, wc.dylib, a modified libcrypto.dylib) execute via the Objective-C `+load` class method (observed entry selector `+[AFImageDownloader load]`), retrieving an AES-256 (ECB mode) encrypted configuration from an Info.plist key ("ccc") or a UserDefaults fallback ("com.tt.cf"). Execution is gated by a guardrail check: the payload validates that the Info.plist "ccool" key equals a fixed string ("77e1a4d360e17fdbc"); if the value differs, the payload does not proceed -- a config-value keying technique consistent with anti-analysis/anti-detonation design. On Android, Java/Kotlin payloads are embedded directly or injected via Xposed/LSPosed hooks into app entry-point Activities, and persist a device-identifier record at `aray/cache/devices/.DEVICES`. Both platforms compute a device identifier (MD5 of IMEI + MAC address + a random UUID on Android) and exfiltrate images via multipart form-data PUT requests to attacker C2 endpoints (`/api/putImages` on iOS, `/api/putDataInfo` on Android), preceded by heartbeat/status checks (`/api/getStatus`, `/api/getImageStatus`, `/api/anheartbeat`) that gate whether upload is permitted based on a `code`/`status` field in the JSON response. iOS traffic spoofs a TikTok User-Agent ("TikTok/31.4.0 (iPhone; iOS 14.8; Scale/3.00)") to blend in with legitimate app traffic. The Android/Kotlin module additionally probes multiple candidate C2 hosts and times each response, committing to whichever host answers fastest. C2 address lists are distributed and rotated via encrypted configuration files hosted on Aliyun OSS buckets (multiple regions: Beijing, Shenzhen, Shanghai), a Gitee repository (bbffipa/data-group), AWS S3, and UFile cloud storage -- allowing operators to update infrastructure without republishing the app binary. Independent researchers noted SparkKitty includes Frida-resistant anti-analysis checks intended to defeat dynamic instrumentation, which were subsequently bypassed via Frida hooking during analysis.

Kaspersky assesses SparkKitty as the successor/"little sibling" to SparkCat (Securelist, disclosed January 2025), the first documented OCR-based crypto-stealer trojan to reach the Apple App Store. SparkCat itself initialized through an SDK component named "Spark" (disguised as an analytics SDK, package `com.spark.stat`) registered in the Android Application subclass's `onCreate` method, downloading base64-encoded, AES-128-CBC-encrypted JSON configuration from GitLab-hosted URLs; a native Rust library (`libmodsvmp.so`) masquerading as an Android code obfuscator implemented a secondary custom TCP C2 protocol using AES-GCM-SIV encryption, ZSTD compression, and RSA key exchange, selectable via a `tfm` configuration flag alongside the primary AES-256-CBC/AES-128-CBC HTTP channel. SparkCat hijacked a legitimate third-party customer-support library (Easemob HelpDesk SDK) to request photo-gallery access under a support-chat pretext, then ran an ML Kit OCR routine that scanned images for wallet-recovery-phrase keywords and dictionary terms across nine languages (Chinese, Japanese, Korean, English, Czech, French, Italian, Polish, Portuguese), exfiltrating matches -- plus device metadata, image hashes, and recognized keywords -- to an AWS S3 bucket and a `/api/e/img/rekognition` endpoint. The two campaigns share overlapping infected Android application sets (including shared package/bundle names such as `com.websea.exchange` across both platforms), identical framework construction methodology, matching iOS debug-symbol file paths (developer paths `/Users/qiongwu/` and `/Users/quiwengjing/`), the same cryptocurrency-theft objective via OCR/ML Kit, and comparable SDK-embedding and C2-configuration patterns, though Kaspersky found insufficient evidence to attribute either campaign to a named group -- Chinese-language code strings and comments, developer-path artifacts, and regional app targeting (China, Southeast Asia) point to a Chinese-speaking, financially motivated operator rather than a nation-state actor. SparkCat was first identified when researchers statically deobfuscated the Google Play food-delivery app "ComeCome" (`com.bintiger.mall.android`, 242,000+ downloads before removal) and discovered its suspicious "Spark" SDK initialization. Following SparkKitty's disclosure, Apple removed 币coin from the App Store (2025-06-25) and Google removed SOEX from Google Play and banned the developer account; the underlying campaign, distribution infrastructure, and app-repackaging technique remain active and continue to surface in new samples and trojanized apps.

## MITRE ATT&CK

- T1475 Deliver Malicious App via Authorized App Store
- T1476 Deliver Malicious App via Other Means
- T1660 Phishing
- T1474 Supply Chain Compromise
- T1624 Event Triggered Execution
- T1444 Masquerade as Legitimate Application
- T1406 Obfuscated Files or Information
- T1627 Execution Guardrails
- T1628 Hide Artifacts
- T1426 System Information Discovery
- T1533 Data from Local System
- T1409 Stored Application Data
- T1437 Application Layer Protocol
- T1481 Web Service
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SparkKitty Trojanized App Distribution & Enterprise Provisioning Profile Abuse** (`TL-2026-1717-SPL-001`)

Detects delivery/exploitation-stage indicators for SparkKitty: MDM/EMM inventory or audit events showing installation of known trojanized apps (币coin, SOEX, the fake-TikTok bundle com.ss-tpc.rd.rdcUniApp) or of the abused iOS enterprise/ad-hoc provisioning profile (certificate EHQ3N2D5WH, profile UUID 55b65f87-9102-4cb9-934a-342dd2be8e25), correlated with proxy/DNS contact to known SparkKitty distribution/redirect domains (accgngrid.com, byteepic.vip, xinqianf38.top, laoqianf51.top, laoqianf15.top, laoqianf14.top, yjhjymfjnj.wyxbmh.cn, moabc.vip) and the impersonation domain i.bicoin.com.cn. This is the initial-access moment where the malicious app or profile lands on the device via authorized-store, phishing/redirect, or supply-chain SDK abuse.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1475, T1476, T1474, T1660, T1627
- **Data sources:** mdm_intune_audit_logs, jamf_mobileiron_inventory, proxy_web_gateway_logs, dns_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mdm (sourcetype="intune:mobileapps" OR sourcetype="jamf:inventory" OR sourcetype="mobileiron:apps" OR sourcetype="intune:audit")
(app_bundle_id="com.ss-tpc.rd.rdcUniApp" OR app_name IN ("币coin","SOEX") OR provisioning_profile_uuid="55b65f87-9102-4cb9-934a-342dd2be8e25" OR certificate_serial="EHQ3N2D5WH")
| eval alert_reason="trojanized_app_or_profile_install"
| table _time, device_id, user, app_name, app_bundle_id, provisioning_profile_uuid, certificate_serial, alert_reason
| append
    [ search index=proxy (sourcetype="pan:threat" OR sourcetype="zscaler:web" OR sourcetype="bluecoat:proxy")
        dest_host IN ("accgngrid.com","byteepic.vip","xinqianf38.top","laoqianf51.top","laoqianf15.top","laoqianf14.top","yjhjymfjnj.wyxbmh.cn","moabc.vip","i.bicoin.com.cn","api.fxsdk.com")
      | eval alert_reason="sparkkitty_distribution_domain_contact"
      | table _time, src_ip, device_id, dest_host, dest_ip, alert_reason ]
| sort -_time
```

### Microsoft KQL

```kql
let SparkKittyDomains = dynamic(["accgngrid.com","byteepic.vip","xinqianf38.top","laoqianf51.top","laoqianf15.top","laoqianf14.top","yjhjymfjnj.wyxbmh.cn","moabc.vip","i.bicoin.com.cn","api.fxsdk.com"]);
IntuneAuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has "Install"
| where Properties has "55b65f87-9102-4cb9-934a-342dd2be8e25" or Properties has "EHQ3N2D5WH" or Properties has "com.ss-tpc.rd.rdcUniApp"
| project TimeGenerated, DeviceId=tostring(Properties.DeviceId), OperationName, Details=tostring(Properties)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (SparkKittyDomains)
    | project TimeGenerated=Timestamp, DeviceId=DeviceName, OperationName="NetworkConnection", Details=strcat("RemoteUrl=", RemoteUrl, " RemoteIP=", RemoteIP)
  )
| order by TimeGenerated desc
```

### Sigma

```yaml
title: SparkKitty Execution Guardrail — Fixed Info.plist Key Gates Payload Activation
id: 7c1e2b3a-4f5d-4e6a-9b7c-1a2b3c4d5e6f
status: experimental
description: Detects the SparkKitty/SparkCat anti-analysis execution guardrail, where the malicious payload (entered via the trojanized +[AFImageDownloader load] class method) only proceeds past its initial check when the app's Info.plist 'ccool' key equals a fixed value (77e1a4d360e17fdbc), gating detonation to expected build/deploy conditions and evidencing the app/profile delivery this rule targets.
references:
    - https://securelist.com/sparkkitty-ios-android-malware/116793/
author: Threadlinqs Team
date: 2026-07-27
tags:
    - attack.initial-access
    - attack.defense-evasion
    - attack.t1475
    - attack.t1476
    - attack.t1474
    - attack.t1660
    - attack.t1627
logsource:
    category: file_event
    product: macos
detection:
    selection_plist_read:
        TargetFilename|endswith: 'Info.plist'
    selection_guardrail_value:
        FileContent|contains:
            - 'ccool'
            - '77e1a4d360e17fdbc'
    condition: selection_plist_read and selection_guardrail_value
falsepositives:
    - Legitimate apps that happen to define an Info.plist key literally named 'ccool' (rare)
    - MTD/EDR agents staging plist-inspection artifacts during routine app vetting
level: high
```

**Known false positives:**

- Legitimate enterprise MDM deployment of an unrelated app that coincidentally shares a generic bundle-id substring — scope matches to the exact bundle IDs/UUIDs/certificate serial listed
- Security research or sandbox environments intentionally installing the sample for analysis

**Tuning notes:** Refresh the distribution-domain and provisioning-profile-UUID/certificate-serial lists from the latest SparkKitty/SparkCat IOC tracking on each pipeline run, since operators rotate landing-page domains frequently (30+ observed since June 2025); extend app_bundle_id/app_name matching to any newly reported trojanized app names beyond 币coin/SOEX.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SparkKitty Trojanized App Distribution & Enterprise Provisioning Profile Abuse (locked: unlock with TL Creds)
- SparkKitty Masqueraded Framework Load, Device-ID Persistence & Xposed/LSPosed Hook Injection (locked: unlock with TL Creds)
- SparkKitty Heartbeat-Gated Multipart Exfil to putImages/putDataInfo with Spoofed TikTok User-Agent (locked: unlock with TL Creds)
- SparkKitty Trojanized App Distribution & Enterprise Provisioning Profile Abuse (locked: unlock with TL Creds)
- SparkKitty Masqueraded Framework Load, Device-ID Persistence & Xposed/LSPosed Hook Injection (locked: unlock with TL Creds)
- SparkKitty Heartbeat-Gated Multipart Exfil to putImages/putDataInfo with Spoofed TikTok User-Agent (locked: unlock with TL Creds)
- SparkKitty Masqueraded Framework Load, Device-ID Persistence & Xposed/LSPosed Hook Injection (locked: unlock with TL Creds)
- SparkKitty Heartbeat-Gated Multipart Exfil to putImages/putDataInfo with Spoofed TikTok User-Agent (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 58)

Defanged, TLP:CLEAR.

- IP address: `23.249.28[.]88`
- Domain: `api[.]fxsdk[.]com`
- URL: `hxxps://gitee[.]com/bbffipa/data-group`

Full set of 58 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SparkKitty Malware](https://gbhackers.com/sparkkitty-malware/)
- [SparkKitty Targets iOS and Android Devices via App Store and Google Play Attacks](https://gbhackers.com/sparkkitty-targets-ios-and-android-devices/)
- [SparkKitty Malware Infects iOS and Android Devices Through App Store and Google Play](https://cyberpress.org/sparkkitty-malware-infects-ios-and-android-devices/)
- [The new SparkKitty Trojan spy in the App Store and Google Play](https://securelist.com/sparkkitty-ios-android-malware/116793/)
- [SparkCat crypto stealer in Google Play and App Store](https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/)
- [SparkKitty: a new stealer in the App Store and Google Play](https://www.kaspersky.com/blog/ios-android-stealer-sparkkitty/53675/)
- [Kaspersky has discovered SparkKitty: a new Trojan spy on App Store and Google Play](https://www.kaspersky.com/about/press-releases/kaspersky-has-discovered-sparkkitty-a-new-trojan-spy-on-app-store-and-google-play)
- [SparkCat -- first OCR trojan stealer to infiltrate the App Store](https://www.kaspersky.com/blog/ios-android-ocr-stealer-sparkcat/52980/)
- [Malware on Google Play, Apple App Store stole your photos -- and crypto](https://www.bleepingcomputer.com/news/security/malware-on-google-play-app-store-stole-your-photos-and-crypto/)
- [Saving Your Wallet Details, Seed Phrase as a Photo on Your Phone? This Trojan May Be Targeting You](https://www.coindesk.com/tech/2025/06/24/saving-your-wallet-details-seed-phrase-as-a-photo-on-your-phone-this-trojan-may-be-targeting-you)
- [Kaspersky Warns New Crypto Malware Steals Seed Phrase Screenshots From iOS and Android](https://cryptorank.io/news/feed/3af3d-kaspersky-warns-new-crypto-malware-steals-seed-phrase-screenshots-from-ios-and-android)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1717