Connect with us

Uncategorized

Saving Your Wallet Details, Seed Phrase as a Photo on Your Phone? This Trojan May Be Targeting You

Published

on

A new strain of mobile spyware, dubbed SparkKitty, has infiltrated Apple’s App Store and Google Play, posing as crypto-themed and modded apps to stealthily extract images of seed phrases and wallet credentials.

The malware appears to be a successor to SparkCat, a campaign first uncovered in early 2025, which used fake support chat modules to silently access user galleries and exfiltrate sensitive screenshots.

SparkKitty takes the same strategy several steps further, Kaspersky researchers said in a Monday post.

Unlike SparkCat, which mostly spreads through unofficial Android packages, SparkKitty has been confirmed inside multiple iOS and Android apps available through official stores, including a messaging app with crypto exchange features (with over 10,000 installs on Google Play) and an iOS app called “币coin,” disguised as a portfolio tracker.

(Securelist)

At the core of the iOS variant is a weaponized version of the AFNetworking or Alamofire framework, where attackers embedded a custom class that auto-runs on app launch using Objective-C’s +load selector.

On startup, it checks a hidden configuration value, fetches a command-and-control (C2) address, and scans the user’s gallery and begins uploading images. A C2 address instructs the malware on what to do, such as when to steal data or send files, and receives the stolen information back.

The Android variant utilizes modified Java libraries to achieve the same goal. OCR is applied via Google ML Kit to parse images. If a seed phrase or private key is detected, the file is flagged and sent to the attacker’s servers.

Installation on iOS is done through enterprise provisioning profiles, or a method meant for internal enterprise apps but often exploited for malware.

(Securelist)

Victims are tricked into manually trusting a developer certificate linked to “SINOPEC SABIC Tianjin Petrochemical Co. Ltd.,” giving SparkKitty system-level permissions.

Several C2 addresses used AES-256 encrypted configuration files hosted on obfuscated servers.

Once decrypted, they point to payload fetchers and endpoints, such as/api/putImages and /api/getImageStatus, where the app determines whether to upload or delay photo transmissions.

Kaspersky researchers discovered other versions of the malware utilizing a spoofed OpenSSL library (libcrypto.dylib) with obfuscated initialization logic, indicating an evolving toolset and multiple distribution vectors.

While most apps appear to be targeted at users in China and Southeast Asia, nothing about the malware limits its regional scope.

Apple and Google have taken down the apps in question following disclosure, but the campaign has likely been active since early 2024 and may still be ongoing through side loaded variants and clone stores, researchers warned.

Read more: North Korean Hackers Are Targeting Top Crypto Firms With Malware Hidden in Job Applications

Continue Reading
Click to comment

Leave a Reply

Ваш адрес email не будет опубликован. Обязательные поля помечены *

Uncategorized

Coinbase Outpaces S&P 500 With 43% June Rise as Stablecoin Narrative Grows: CNBC

Published

on

By

Shares of Nasdaq-listed cryptocurrency exchange Coinbase (COIN) rose 43% this month, making the firm the top performer in the S&P 500 since it joined the index at the end of last month.

June’s run is already the stock’s best since November and caps three straight monthly gains. Coinbase’s shares reached their highest level since their public debut.

COIN hit a $382 high this week before enduring a slight correction, ending the week at $353 and seeing a slight 0.7% drop in after-hours trading to $351.

The wider S&P 500 index rose roughly 5% in June as geopolitical tensions eased.

Washington’s progress on the GENIUS Act, Congress’s first rulebook for dollar-pegged stablecoins, helped shift investor focus from trading fees to stablecoin revenue.

The bill brightened the outlook for Circle, whose shares hit a record high and saw its market cap near that of Coinbase this week.

Coinbase keeps all yield on USDC balances held on its platform and nearly half of other USDC income, equal to about 99 percent of Circle’s revenue, giving shareholders indirect exposure at no added cost, CNBC reported Friday, citing analysts including Citizens’ head of financial technology research Devin Ryan.

Trading, however, remains subdued. Average daily volume on Coinbase has drifted lower since April.

Continue Reading

Uncategorized

Robinhood Launches Micro Bitcoin, Solana and XRP Futures Contracts

Published

on

By

Robinhood (HOOD) has introduced micro futures on bitcoin (BTC), solana (SOL) and XRP in the United States., expanding its existing crypto futures offering for its nearly 26 million funded accounts.

Micro contracts need far less collateral than full-size futures, letting traders take directional positions while committing a smaller slice of capital.

The contracts offer traders more flexibility to bet on a cryptocurrency’s future price direction or hedge current positions given their smaller size.

The launch rounds out a futures suite that began with BTC and ETH in January. It also comes weeks after the firm closed its $200 million purchase of Bitstamp and finalized a $179 million deal for Canada’s WonderFi.

Robinhood’s data shows that crypto notional volumes have exploded upward over time, reaching $11.7 billion in May. The figure marks a 36% rise month-over-month, and a 65% growth year-over-year.

Continue Reading

Uncategorized

Why is XRP Up Today? Trio of Catalysts Sees Token Outperform Wider Crypto Market

Published

on

By

XRP climbed 5.5% to $2.19 in the last 24 hours after a trio of catalysts converged to help the cryptocurrency outperform the wider cryptocurrency market.

One of the catalysts was launch of XRP micro futures on Robinhood. The contracts offer traders more flexibility to bet on the cryptocurrency’s future price direction or hedge current positions given their smaller size.

Regulatory fog also thinned. On Friday, Ripple withdrew its cross-appeal in its long-running U.S. Securities and Exchange Commission (SEC) lawsuit. The SEC sued Ripple back in 2020 over its XRP sales, alleging these violated securities laws. The SEC is expected to drop its own appeal, leaving last year’s ruling, ordering Ripple to pay a $125 million civil penalty to the SEC, intact. The move could lift a lid that had kept some investors on the sidelines.

On-chain data rounded out the bullish setup. The XRP Ledger logged over a 1.1 million active addresses over the past week according to crypto analyst Ali Martinez, who cited Glassnode data.

XRP’s rise saw it outperform the wider crypto market, with the broader CoinDesk 20 (CD20) index rising 1.7% in the last 24 hours.

Continue Reading

Trending

Copyright © 2017 Zox News Theme. Theme by MVP Themes, powered by WordPress.