NewMalicious App · iOSSparkCat returned with deeper obfuscation and English-language targeting
At a glance
- Affected apps
- SafeW, Wukong Delivery
- Variant
- English keyword support
- Technique
- Obfuscated OCR spyware
- Reported by
- Kaspersky
What happened
Kaspersky found an upgraded SparkCat variant in April 2026. The campaign moved beyond mainly Asian-language targets and added English detection, widening the potential victim base.
The same malicious pattern continues to evolve instead of disappearing after its first exposure.
What was found
The new version used code virtualization and cross-platform development to hide its behavior more deeply. Its purpose remained the same: find screenshots of crypto-wallet recovery phrases in the photo library.
Data at risk
- Photo library
- Seed phrases
- Crypto wallets
- English-language users
- Screenshots
- Cloud-office data
What you should do
- Treat unrelated office and lifestyle apps with caution.
- Do not keep screenshots of seed phrases in Photos.
- Remove SafeW or Wukong Delivery if present.
- Watch for updated Kaspersky and SlowMist advisories.
View original postThe Hacker News · Kaspersky