加密资产安全

The new malware SparkKitty is threatening the security of crypto assets on mobile devices.

After months of observation of different mobile operating systems, the well-known security company Kaspersky has discovered new malware SparkKitty is quietly spreading through tampered applications.

This malware is actually an upgraded version of the SparkCat malware from early February this year, and its harmfulness has significantly increased. Attackers first implant malicious code into seemingly normal applications, including cryptocurrency price trackers, instant messaging software, etc. One messaging application named SOEX had surpassed 10,000 downloads before being removed from the app store.

It is worth noting that these infected applications, after obtaining access to user photo album permissions, continuously scan the device's image data, specifically searching for images that may contain cryptocurrency wallet seed phrases. Reports indicate that this malware specifically targets crypto users, particularly in China and Southeast Asia.

The distribution channels for this malware are not limited to crypto-related applications; it also disguises itself as casino programs, adult websites, and even impersonates TikTok applications to spread. Compared to earlier versions, the attack range of SparkKitty has expanded from simple theft of crypto assets to various types of sensitive data, but its core target remains stealing mnemonic phrases for digital wallets.

Security experts particularly warn that this malware has a strong concealment capability; even if users grant photo album permissions, the application will still appear to operate normally on the surface while actually conducting data scans in the background.

In response to this new threat, Kaspersky advises users to never store seed phrases in digital form, including the common but dangerous practice of taking photos of mnemonic phrases. Additionally, users should carefully manage application permissions, especially photo album and file access permissions.

In summary, for users holding digital assets, using hardware wallets or storing mnemonic phrases in paper form offline is the safest storage method. As malware technology evolves, the means of stealing digital assets from mobile devices have become increasingly concealed and complex. Therefore, users must remain highly vigilant and regularly check device permission settings to guard against potential security risks.

#恶意软件 #加密资产安全 #数据隐私