Cybersecurity company: SparkKitty malware will capture your seed phrase screenshots.

Gate News bot news, according to CoinTelegraph, cybersecurity company Kapersky warns that a newly discovered malware named SparkKitty is stealing photos from infected devices in an attempt to find encryption seed phrases.

Kaspersky analysts Sergey Puzan and Dmitry Kalinin reported on Monday that SparkKitty is targeting iOS and Android devices by infiltrating some applications on the Apple App Store and Google Play.

Once the device is infected, malware will indiscriminately steal all images from the photo library.

"Although we suspect that the primary goal of the attacker is to find screenshots of the encryption wallet seed phrase, there may also be other sensitive data in the stolen images."

Kapersky discovered that two applications used to spread malware are focused on cryptocurrency. One of them, called "Coin", is available on the App Store and promotes itself as a cryptocurrency information tracker. The second is SOEX, a messaging application on Google Play that has "cryptocurrency trading features".

Puzan and Kalinin stated: "This app has been uploaded to Google Play and has been installed over 10,000 times. We have informed Google about this matter, and they have removed it from the store."

A Google spokesperson confirmed to cryptocurrency media that the app has been removed from Google Play and the developer has been banned.

The spokesperson said: "Regardless of the download source, Android users are automatically protected by Google Play Protect, a feature that is enabled by default on Android devices with Google Play services installed."

Kapersky analysts also found that SparkKitty spreads through casino apps, adult-themed games, and malicious TikTok clones.

This malware is similar to SparkCat, which was discovered in a Kapersky investigation in January this year. This malware scans user images to find encryption wallet recovery phrases.

Puzan and Kalinin stated that the two versions of malware may come from the same source, as they have similar functionalities and contain similar file paths from the attackers' systems.

Analysts say: "Although it is not complex in terms of technology or concept, this event has posed a significant threat to users since at least the beginning of 2024."

"Unlike the previously discovered SparkCat spyware, this malware is not picky about the photos stolen from the photo gallery."