You create a crypto wallet, write down your recovery phrase, and take a photo just in case. Maybe you even move it to a hidden album. It feels like a convenient backup. After all, who else knows the photo is there?

Unfortunately, some malware can scan thousands of images for wallet recovery phrases. It does not need to break into your crypto wallet first.

How Can an Ordinary App Find Your Seed Phrase?

On April 2, 2026, Kaspersky reported a new variant of the SparkCat Trojan found in apps on both Apple’s App Store and Google Play. Researchers identified two infected iOS apps and one Android app, disguised as legitimate business messaging and food delivery services. The malicious code was subsequently removed from the stores.

The target was not the wallet application itself. It was the wallet’s backup.

When granted access to a phone’s photos, SparkCat could use optical character recognition (OCR) to read text inside images. It is the same basic technology that lets you copy text from a photographed document. In this case, it searched for signs of crypto recovery phrases and could send matching images to attackers.

The Android variant searched for specific words in Japanese, Korean, and Chinese. The iOS variant looked for English mnemonic phrases, potentially exposing users across regions. The research describes malware capabilities and distribution, not a verified total of funds stolen in this 2026 campaign.

Why Are 12 or 24 Words So Valuable?

A seed phrase is not just a password for opening an app. In many modern wallets, it is used to restore the cryptographic keys that control your assets.

If someone gets a valid recovery phrase, they may be able to rebuild the wallet on another device and transfer funds without ever touching your phone. Losing a device and exposing a recovery phrase are therefore very different problems. A device can be replaced; a stolen recovery phrase may give someone else the same recovery capability.

For a closer look at how seed phrases and private keys relate, see our explanation of crypto private keys.

But Aren’t App Store and Google Play Apps Reviewed?

They are, but review systems cannot guarantee that every malicious app is caught. SparkCat is a useful example: researchers first identified the family in 2025, and in April 2026 found a new version using additional techniques to conceal its code.

Downloading from official stores is still a sensible precaution. It simply should not be your only security decision, especially when an app requests access to personal photos.

What If You Use a Hardware Wallet?

Consider two different backups.

Scenario one: You keep a screenshot of your seed phrase on your phone. Malware with access to your photos may be able to find and copy it remotely.

Scenario two: You use a hardware wallet and write the recovery phrase on paper. Your signing keys are isolated from your phone, and malware cannot simply retrieve that offline sheet. But anyone who physically obtains or photographs the paper may be able to copy the phrase.

These are not equivalent risks. A paper backup avoids the gallery-scanning attack described above. But both scenarios show that safeguarding keys inside a device is only part of the job: the backup needs its own security model.

ERA Wallet device approaches these two layers separately. Its air-gapped signing uses QR codes rather than a direct phone-to-device connection. For recovery, ERA Recovery Card stores an encrypted backup on an NFC card, protected by a card PIN. The backup can be created without displaying the seed phrase on-screen or manually copying it onto paper. That reduces the need to expose the phrase in a directly readable form during backup.

You can learn about the supported recovery options in the ERA Wallet backup guide.

The principle is simple: protecting a hardware wallet also means protecting the way you restore it.

How to Protect Your Recovery Phrase

• Do not photograph or screenshot your recovery phrase.

• Do not send it through email, messaging apps, or ordinary cloud notes.

• Review which apps have access to your photo library.

• Choose a backup method that addresses both loss and unauthorized access.

• If you suspect the phrase has been exposed, create a fresh wallet in a trusted environment and move any remaining funds to addresses derived from the new recovery phrase.

Deleting a photo does not necessarily erase cloud copies, device backups, or a copy already taken by malware.

Key Security Does Not End at the Device

SparkCat illustrates a practical reality of crypto security: attackers do not always need to defeat sophisticated cryptography. Sometimes they can target a more exposed copy of the secret.

A hardware wallet can keep signing keys separate from everyday software. But backup choices remain a distinct responsibility. So alongside asking how well your device protects your keys, ask one more question: how many copies of those secrets exist, and who could get to them?

Want a recovery setup that does not require writing down your seed phrase? Explore ERA Wallet device and its encrypted NFC Recovery Card. Explore ERA Wallet Code ERABLOG20 for 20% off.