MOBILE MALWARE

The malware that reads your screenshots for a crypto seed phrase

A quiet trick keeps resurfacing in security news, most recently in late July 2026: malware that does not need to phish you at all. It rides inside an ordinary-looking app, asks for photo access, and then reads the text inside your pictures looking for one thing, a crypto wallet recovery phrase you once saved as a screenshot. Kaspersky named the family SparkCat in February 2025 and its successor SparkKitty in June 2025, and found it on both Google Play and the Apple App Store. Here is exactly how it works, and the one storage habit that makes you immune to it.

SB

SafeBrowz Threat Research Security ResearchJuly 29, 20269 min read

What SparkCat and SparkKitty actually are

Most crypto theft starts with a link: a fake airdrop, a lookalike login, a drainer page that asks you to connect a wallet. This family skips the link entirely. It is a mobile trojan that comes pre-loaded inside an app you install yourself, and it steals from the one place people wrongly assume is private, their camera roll.

Kaspersky's research team disclosed the first strain, SparkCat, in February 2025. It was hidden in a malicious software development kit (SDK) bundled into real-looking apps, including a food-delivery app called ComeCome and several messaging apps, and it was distributed on both Google Play and the Apple App Store. That App Store presence made it notable: Kaspersky described it as the first known OCR-based stealer trojan found in Apple's official store, which punctured the common belief that anything on the App Store is automatically safe. In June 2025 Kaspersky documented the successor, SparkKitty, calling it "SparkCat's little brother." SparkKitty cast a wider net, with some versions grabbing every image in the gallery rather than only the ones with text.

The important correction, because these names get garbled in re-reporting: the family is SparkCat and SparkKitty, the research is Kaspersky's, and it dates to 2025, not a brand-new discovery. When it trends again, as it did in late July 2026 across crypto-news outlets, that is an awareness wave, not a new campaign. The threat is real and ongoing; the framing of "breaking new malware" usually is not. What is genuinely newer is a variant analysts flagged in 2026 that widened the target list, covered below.

How it reads a seed phrase out of your photos

The mechanism is simpler and more unsettling than a typical phishing kit. There is no fake page and no signature to approve. It is pure device access plus text recognition.

1. A normal-looking app asks for photo access. You install a messenger, a crypto price tracker, a food or utility app. At some point it requests access to your photos, a permission that feels routine because so many apps ask for it.
2. It runs OCR across your gallery. Once it can read your images, the malware uses an optical character recognition engine (Kaspersky identified Google's ML Kit OCR in these samples) to convert the text inside every picture into machine-readable words. Your screenshots stop being opaque images and become searchable text.
3. It filters for recovery phrases. It looks for the tell-tale shape of a seed phrase: a block of common dictionary words, in the right count and pattern, across multiple languages. Early samples were tuned for Chinese, Japanese, Korean, and several European languages.
4. It exfiltrates only the matching images. The versions built around OCR do not need to upload your whole camera roll. They quietly send back just the pictures that contain what looks like a wallet phrase, which keeps data use low and the theft unnoticed.
5. The attacker drains the wallet. A recovery phrase is the master key to every address a wallet derives. Whoever has your 12 or 24 words can rebuild the wallet on their own device and move everything out, on every chain, usually within minutes. There is nothing to revoke, because they now hold the wallet itself.

That is the whole attack. It works because a screenshot feels like a private, harmless thing to keep, when in fact it is plaintext to any app that can read your gallery.

Install SafeBrowz free

Add the browser extension, or the SafeBrowz Android app, that checks links before they open so a fake app-download or fake wallet page never gets the chance to load. Free forever, with optional Premium AI deep scan at $14.99 per year.

Need to check a suspicious link right now? Click here to scan it free →

Add to Chrome Add to Firefox Add to Edge Get it on Google Play

See pricing and Premium features

Why a screenshot of your recovery phrase is the whole wallet

People screenshot their seed phrase for an understandable reason: they are afraid of losing it. During wallet setup you are shown 12 or 24 words and told to write them down, and a photo feels like the fastest, safest backup. It is the opposite. A written phrase in a drawer is offline and can only be read by someone physically holding it. A screenshot lives in a gallery that is synced to the cloud, searchable by OCR, and reachable by any app you grant photo access to.

The reason the rule is absolute is that a seed phrase is not a password to one account. It is the master secret from which every private key in the wallet is generated. Anyone who has the words can recreate the entire wallet on any device and control every address it has ever held or will ever hold. There is no "change it" and no "revoke" once it leaks, because the words are the wallet. That is why hardware wallets and paper or steel backups exist: to keep the phrase in a form that never touches an internet-connected photo library in the first place.

The apps it hid inside (all since removed)

These campaigns did not rely on shady third-party stores. The whole point of the research was that the malware reached the official ones.

• SparkCat was found inside apps like the food-delivery app ComeCome plus several messaging apps, on both Google Play and the App Store. Kaspersky reported the infected Google Play apps had been downloaded more than 242,000 times.
• SparkKitty appeared in an Android app called SOEX (a messaging app with crypto-exchange features, with more than 10,000 Google Play installs) and an iOS app called 币coin, alongside modified TikTok builds and various crypto and gambling apps, some installed through iOS enterprise provisioning profiles.
• A 2026 variant was spotted in an app called SafeX, showing the family is still being rebuilt and redistributed rather than being a one-time event.

Every named app was removed from the stores after Kaspersky's disclosures, so this is not a list of things to go uninstall today. It is the proof point: an app can pass store review and still carry this. Treat "it is on the official store" as necessary, not sufficient, and keep your seed phrase out of any app's reach regardless.

The 2026 update: it now hunts English seed phrases too

The reason this keeps mattering is that the family evolves. In 2026, researchers flagged a SparkCat variant whose iOS build had been expanded to scan for English-language recovery phrases, widening the target pool well beyond the original Asia-focused campaigns. Newer samples also added code obfuscation to make analysis harder. The practical takeaway is simple: do not assume this is a regional problem that will not reach you, and do not assume it is "old news." The delivery apps change, the languages expand, and the core trick, read your gallery, find your phrase, stays the same.

How to keep your seed phrase off the camera roll

You do not need to hunt for malware to beat this. Remove what it is looking for, and lock the door it comes through.

1. Never store a seed phrase as a screenshot, photo, or file. Not in Photos, not in Notes, not in a cloud drive, not in a password manager's image field, not in a chat to yourself. If it can be opened as text or an image, it can be read.
2. Write it on paper, or stamp it into metal, kept offline. This is the entire reason offline backups and hardware wallets exist. The phrase should live somewhere that is never connected to the internet and never handed to an app.
3. Audit which apps can see your photos. On both iPhone and Android you can review and revoke photo-library access per app. Deny full gallery access to anything that has no genuine need for it: a price tracker, a game, or a messenger does not need your whole camera roll. Prefer "Selected Photos" or "None" over "Allow All" wherever the app still works.
4. Install only from trusted developers, and stay skeptical even on official stores. SparkCat proved both Google Play and the App Store can be breached. Avoid modified or "cracked" apps, avoid installing profiles you are prompted to trust, and be wary of a fresh app with few reviews asking for photo access.
5. Delete any existing seed-phrase screenshots now, everywhere. Search your gallery, delete the image, empty the "Recently Deleted" album, and remove it from any cloud photo backup (iCloud Photos, Google Photos) where it may still exist.

I saved my seed phrase as a screenshot. What now?

Do not panic, but do move. Having a screenshot is not proof you were robbed; it means the phrase has been sitting somewhere readable, so the safe assumption is that it could be exposed. Act as if it might be.

1. Create a brand-new wallet with a new recovery phrase, on a clean device. Generate a fresh phrase that has never been photographed or typed into anything. A hardware wallet from ledger.com or trezor.io is the strongest option for anything valuable.
2. Move your assets to the new wallet, most valuable first. Transfer high-value tokens and NFTs before the small balances. If you have real reason to think the old phrase already leaked, treat this as urgent and watch for sweeper bots that grab incoming gas.
3. Delete the screenshot everywhere. Remove it from the gallery, from "Recently Deleted," and from every cloud photo backup. The image is the exposure; get rid of it.
4. Stop using the old wallet for anything of value. Once a phrase has been exposed, that wallet can never be fully trusted again. Do not move new funds into it or reuse the phrase anywhere.
5. Audit your app permissions and remove anything suspicious. Revoke photo access from apps that do not need it, and uninstall any recently added app you are unsure about.
6. Ignore anyone offering paid "fund recovery." People promising to retrieve stolen crypto for an upfront fee are a second scam that targets victims of the first. Our full playbook is here: what to do when your seed phrase is stolen.

Frequently asked questions

Is "SparkKit" malware real, or is it SparkCat?

The real malware family is SparkCat and its successor SparkKitty, both named and documented by Kaspersky (SparkCat in February 2025, SparkKitty in June 2025). "SparkKit" is a garbled version of the name that appears in some re-reporting. It is the same threat: apps that use OCR to read crypto seed phrases from the screenshots in your photo gallery. The threat is genuine; the primary research is Kaspersky's, and it is from 2025, so when it trends again it is renewed awareness rather than a brand-new discovery.

Can malware really read a seed phrase from a screenshot?

Yes. Once an app has permission to see your photos, it can run optical character recognition (OCR) to convert the text inside your images into searchable words, then filter for the pattern of a 12 or 24 word recovery phrase. Kaspersky found exactly this in the SparkCat and SparkKitty apps. A screenshot is not a private, opaque thing; it is plaintext to any app that can read your gallery, which is why you should never keep a seed phrase as an image.

Was this on iPhone too, or only Android?

Both. Kaspersky found infected apps on Google Play and, notably, on Apple's App Store, which is what made the research stand out. SparkCat was described as the first known OCR-based stealer trojan in the App Store. So this is not an Android-only or sideloading-only problem, and being on an official store does not make an app safe by itself.

I have my seed phrase saved as a screenshot. Am I hacked?

Not necessarily, but you should act as if the phrase could be exposed. Having a screenshot is a risk, not proof of theft. The safe move is to create a new wallet with a fresh recovery phrase on a clean device, move your assets to it, then delete the screenshot from your gallery and every cloud photo backup. Stop using the old wallet for anything valuable, and never store a phrase as an image again.

How should I store a recovery phrase safely?

Offline, in a form no app can read. Write the 12 or 24 words on paper, or stamp them into a metal backup plate, and store that physically somewhere safe. For larger amounts, use a hardware wallet so the phrase is generated and kept on a device that never exposes it to the internet. Never keep it as a screenshot, photo, note, chat message, or cloud file, and deny photo-gallery access to apps that do not genuinely need it.

Related SafeBrowz coverage

• Your crypto seed phrase was stolen: what to do
• What are crypto wallet drainers and how they work in 2026
• Fake ETH Genesis airdrop seed-phrase drainer
• Permit2 signature attack explained
• How to tell if a website is a scam
• I got scammed: what to do in 2026

Bottom line: SparkCat and SparkKitty are real, Kaspersky-documented malware that reach the official app stores, ask for photo access, and use OCR to read crypto seed phrases out of your screenshots. A recovery phrase saved as an image is the entire wallet, readable by any app that can see your gallery. You beat the whole category with two habits: never store a seed phrase as a screenshot or file, and deny photo access to apps that do not need it. Keep SafeBrowz on your browser so the fake app-download and lookalike wallet links that spread this never load in the first place.