Rare Screenshot-Grabbing Malware Found on Apple App Store

Yahoo

07-02-2025

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.
In what appears to be a first, a strain of malware that can secretly steal screenshots from smartphones has infiltrated the Apple App Store.
The so-called 'SparkCat' malware was discovered late last year secretly embedded in an iOS app called 'ComeCome-Chinese Food Delivery,' according to antivirus provider Kaspersky.
SparkCat works by secretly deploying a character-recognition tool, enabling it to read text from stored images and seek out select keywords. If the desired words are found, the malware will then send the image to a hacker-controlled server.
'The [search] terms all indicated that the attackers were financially motivated, specifically targeting recovery phrases also known as 'mnemonics' that can be used to regain access to cryptocurrency wallets,' Kaspersky concluded.
The antivirus provider's investigation also found that the malware will seek keywords in languages including Chinese, Japanese, Korean, English, Czech, French, Italian, Polish, and Portuguese. This suggests the attack was devised to prey on users in Europe and Asia.
'It must be noted that the malware is flexible enough to steal not just these phrases but also other sensitive data from the gallery, such as messages or passwords that might have been captured in screenshots,' Kaspersky said.
The malicious code was also found in a few other iOS Apps, such as "AnyGPT" and "WeTink." The findings prompted Apple to remove a total of 11 iOS apps from its official store.
Apple also told PCMag that the 11 apps shared computer code with 89 other iOS apps, which have also been removed or rejected. In addition, the developer accounts behind the apps have been terminated.
Despite the malicious threat, Apple also noted that starting in iOS 14, the PhotoKit API lets users select only specific photos or videos to share with an app, rather than providing full access to the entire library. The company added that it has no tolerance for malicious activity and designed its app store to be safe and private for users.
Kaspersky uncovered the iOS malware after spotting the malicious code operating through a variety of infected apps on the Google Play Store. Those apps were downloaded more than 242,000 times via Google Play and also circulated through unofficial app stores.
"Analyzing Android versions of the malware, Kaspersky experts found comments in the code written in Chinese," it said. "Additionally, the iOS version contained developer home directory names, 'qiongwu' and 'quiwengjing,'" suggesting that the threat actors are fluent in Chinese.
Google didn't immediately respond to a request for comment. But Kaspersky says its notified Google about the malware, too.
It's unclear how so many apps became infected with the malware. Some of the infected apps appear to be legitimate food delivery services while others seem to be fake programs meant to bait users. In the meantime, Kaspersky says: 'This case once again shatters the myth that iOS is somehow impervious to threats posed by malicious apps targeting Android.'
This story has been updated with comment from Apple.