SparkCat malware steals wallet phrases from photos

TLDR

SparkCat is new mobile malware that scans your photos for crypto wallet recovery phrases and sends them to hackers, putting funds at risk if you stored phrases as images.

1. Researchers describe SparkCat as a Trojan hidden in seemingly normal apps that uses OCR to search your camera roll for wallet seed phrases and uploads matching photos to attackers.
2. This targets a very common bad habit in crypto security: storing seed phrases as screenshots or photos that are quietly synced to the cloud and exposed to any app with photo access.
3. The safer approach is to keep recovery phrases strictly offline, lock down app photo permissions, and, if you ever stored a phrase as an image, treat that wallet as compromised and migrate.

Deep Dive

1. How SparkCat Steals Phrases

Security researchers report that the SparkCat Trojan has been found inside seemingly harmless apps on both official app stores and third party sites, allowing it to bypass normal user suspicion.

Once installed, SparkCat asks for broad permissions, then silently scans the devices camera roll using an optical character recognition (OCR) module to detect words and patterns associated with wallet recovery phrases. According to one detailed write up, if it finds such content it immediately sends the image to a remote server controlled by the attackers, who can then reconstruct the wallet and drain funds.

SparkCat was first identified in 2025 and recent analysis shows it has evolved to evade store security reviews and target crypto users more precisely by focusing on seed phrase keywords in photos.

2. Why Photos Are A Prime Target

Many wallet setups show the seed phrase on screen, and users often take screenshots or quick photos instead of writing it down, thinking they will store it safely later. Those images usually get backed up automatically to cloud services.

Malware like SparkCat turns the camera roll into an attack surface, since any app granted photo access can, in principle, scan those backups and exfiltrate critical data. Researchers already warn that recovery phrases should never be stored in screenshots, photos, emails, or notes for exactly this reason.

3. Practical Defenses For Crypto Users

Safer practice is to write recovery phrases on durable physical media (for example metal or paper in a secure place) and never photograph or digitally copy them.

On your phone, it helps to: restrict photo and file permissions to apps that truly need them, uninstall unknown or low reputation apps, and favor official app stores while still reading developer details and reviews carefully.

If you have ever stored a seed phrase as a photo or screenshot and suspect your device or apps may be compromised, a conservative response is to create a new wallet with a new phrase and move funds there.

Conclusion

SparkCat highlights that the weakest link in crypto security often sits on the phone and in cloud backups, not on the blockchain itself. By avoiding digital storage of recovery phrases and tightening app permissions, users can meaningfully reduce the risk that a single piece of malware quietly turns an old screenshot into a total wallet loss.