Apple and Google have removed 20 apps from their stores after researchers discovered they contained malware stealing user data for nearly a year.
Security firm Kaspersky found the malware, called SparkCat, active since March 2024. It was first spotted in a food delivery app in the UAE and Indonesia before being found in 19 other apps, with over 242,000 downloads from Google Play.
SparkCat used optical character recognition (OCR) to scan device screens and image galleries, searching for cryptocurrency wallet recovery phrases in multiple languages. This allowed attackers to take over wallets and steal funds. The malware could also extract sensitive data like messages and passwords from screenshots.
Google confirmed it removed all affected apps and banned the developers, while Android users were protected through Google Play Protect. Apple has also pulled the apps but has not commented. Researchers warn that SparkCat may still be available on third-party sites and unofficial app stores.
