NewMalicious App · App StoreSparkCat used App Store apps to scan seed-phrase screenshots
At a glance
- Affected apps
- ComeCome, AnyGPT, WeTink
- Channel
- Official App Store
- Technique
- OCR screenshot scanning
- Reported by
- Kaspersky
What happened
Several App Store apps carried an OCR trojan that searched photo libraries for screenshots containing crypto-wallet seed phrases. Kaspersky described it as the first OCR spyware found in an official app store.
Some affected apps were still downloadable when the campaign was disclosed.
What was found
The malware used Google ML Kit to read images, match wallet-related keywords and upload relevant screenshots. It was unclear whether developers added it intentionally or inherited it through a compromised supply chain.
Data at risk
- Photo library
- Seed phrases
- Wallet access
- Screenshots
- Crypto assets
- Personal images
What you should do
- Delete screenshots that contain wallet seed phrases.
- Store recovery phrases offline on paper or metal.
- Remove any affected app from the device.
- Review wallets for activity you do not recognize.
View original post9to5Mac · Kaspersky