A recovery phrase photographed “just for now” becomes a file, and software you installed for something else can read it. Security researchers found this malware in official app stores in 2025, and it returned in 2026. Here is how it works, and the habit that leaves it nothing to find. Published for Cybersecurity Awareness Month 2026.

Kaspersky found SparkCat and SparkKitty, mobile Trojans, in apps on Google Play and Apple’s App Store in 2025, and a new SparkCat variant returned to both stores in April 2026. Once a user grants photo access, the app searches the gallery for images of wallet recovery phrases and uploads them. The defense costs nothing: users never photograph a seed phrase, so the gallery holds nothing worth stealing.

It came back a year after it was removed

On April 2, 2026, Kaspersky reported a new SparkCat variant inside legitimate-looking apps in both stores: two on the App Store and one on Google Play, including a messenger for enterprise communication and a food-delivery app. Kaspersky removed the code by the time of the announcement, after notifying Apple and Google. The same apps also circulated through third-party websites, some of which mimicked the App Store when opened on an iPhone.

The new Android build hid behind several layers of obfuscation, including code virtualization, which Kaspersky called rare for mobile malware. The Hacker News reported that the apps primarily targeted crypto users in Asia, while the iOS variant scanned for English-language mnemonic phrases, which Kaspersky said makes it potentially broader in reach. Its first move was unchanged from 2025: ask for access to the photo gallery.

Where it started: a food-delivery app that wanted to see your photos

In February 2025, Kaspersky described a food-delivery app called ComeCome, available on both Google Play and the App Store, that included a hidden module. When a user allowed the app to see their photos, the module ran optical character recognition across the gallery, hunting for words that belong to a crypto wallet recovery phrase. It sent matching images to a server the attackers controlled.

Kaspersky named the campaign SparkCat. By its account, the malware had been active since at least March 2024, the infected Google Play apps had been downloaded more than 242,000 times, and this was the first stealer of its kind found in Apple’s App Store. The Hacker News reported that Apple removed the offending apps from both stores by February 7, 2025. The researchers’ summary was blunt: nothing in the app hinted at a malicious implant.

How OCR malware turns a gallery into a search index

The module does not look at your photos the way a person would. It reads them. SparkCat shipped as an analytics-style SDK that decrypted and launched an OCR plug-in built on Google’s ML Kit library, then compared the recognized text against keyword lists in several languages, the vocabulary of recovery phrases. It uploaded only matching images, keeping network traffic low and the app’s behavior unremarkable. From the user’s side, the permission request looked like something the app needed.

The idea was not new. Kaspersky’s report noted that in March 2023 ESET had found OCR implants in modified messaging apps scanning galleries for the same thing, though those spread through unofficial downloads. SparkCat’s advance was the delivery channel: it arrived through the two storefronts people are told to trust.

SparkKitty stopped filtering and took everything

In June 2025, Kaspersky found a related family it called SparkKitty. It hid in crypto and gambling apps, as well as a modified TikTok build. On the App Store, it posed as a crypto app named 币coin; on Google Play, it sat inside SOEX, a messaging app with exchange features that Kaspersky says had been installed more than 10,000 times. Where SparkCat selected images by OCR, SparkKitty uploaded gallery photos wholesale and kept watching for new ones. Security firm Certo, summarizing Kaspersky’s analysis, noted that on iOS the attackers also abused enterprise provisioning profiles to install apps outside the store, and that most victims were in Southeast Asia and China. It was the second time in a year that a stealer had been found in the App Store.

What gives it away

Very little, which is the point. The clearest signal is a permission request that doesn’t fit the app’s job: a delivery app, a chat app, a game, or a “portfolio tracker” wanting full access to your photo library. Another is a developer name you cannot find anywhere else. Reviews, ratings, download counts, and a place on an official store are not signals; every one of these campaigns passed review.

The Cybersecurity Awareness Month advice to use strong passwords hits harder in self-custody. A seed phrase is the master password for everything in the wallet, and there is no reset link.

The check: leave the gallery with nothing to find

• Write the phrase on paper or stamp it in metal, and keep it offline in two separate places. Never photograph it, screenshot it, dictate it to a voice assistant, or type it into a notes app.

• If a phrase has ever been photographed or screenshotted, treat the wallet as exposed now, not after a cleanup. On a different device you trust, create a new wallet, write its phrase on paper, and move the funds there. Do this before touching anything on the phone that held the picture: if that phone is infected, deleting the screenshot changes nothing about a copy already uploaded.

• Then clean up for the future. Search your gallery and cloud photo backups for old screenshots of phrases or private keys, delete them, and empty the “recently deleted” folder. This protects wallets you create from now on, not the one already exposed.

• When an app asks for photo access, grant access only to selected photos, or deny it. Both iOS and Android offer the limited option.

• Review which apps hold photo permissions every few months, and remove apps you no longer use.

• Install from official stores, but treat the store as a filter, not proof. Read what the app wants before you tap Allow.

What the check does not prove

A clean store listing proves only that the app passed review on the day it was checked; SparkCat passed twice, a year apart. Cloud backups may hold copies you forgot about. The habit works because it removes the target, not because it detects the thief.

Where this meets your swap

SimpleSwap is a self-custodial, wallet-to-wallet swap aggregator: funds move from a wallet you own to a wallet you own, and the service never sees your seed phrase or your phone. That is also the limit. A phrase read from a photo gives the attacker your wallet, and every transaction they sign from it looks exactly like one you signed. No swap service, SimpleSwap included, can tell the difference or reverse the result.

Two things are within our reach. First, the information itself: the Safety Academy and the Know the Scam series exist so people know this pattern before it costs anything. The second is our own conduct. SimpleSwap support never messages first and never asks for a recovery phrase, and you should install the SimpleSwap app only from links published on simpleswap.io. Our only official domain is simpleswap.io.

FAQ

Can malware read a seed phrase from a screenshot?
Yes. SparkCat, found by Kaspersky in February 2025, used optical character recognition to find recovery-phrase words in gallery images and uploaded the matches, and a new variant reached the App Store and Google Play again in April 2026. SparkKitty, found in June 2025, uploaded gallery photos wholesale. All of them reached users through official stores.

Is it safe to keep a seed phrase in iCloud or Google Photos?
No. A photo in a cloud library syncs to every signed-in device and can be read by any app granted photo access on any of them. Write the phrase on paper or metal and keep it offline.

How do I know if an app is scanning my photos?
You usually cannot tell from the app’s behavior; these campaigns ran without visible signs. Judge the permission request instead. An app whose job doesn’t involve your photos shouldn’t have full access to them.

Is SimpleSwap safe if my phone is infected?
SimpleSwap never holds your seed phrase, so there is nothing on our side for malware to take. If you ever photographed your phrase, the wallet is at risk regardless of which service you use. Create a new wallet on a different device you trust and move the funds there before you swap anything.

This article is for educational purposes only and is not financial or investment advice. Tools and products named here are examples, not endorsements, and do not replace your own judgment. SimpleSwap’s only official domain is simpleswap.io.