The new SparkKitty Trojan spy in the App Store and Google Play

Kaspersky researchers report a new spyware Trojan, which they believe is connected to the earlier SparkCat campaign, that has reached the official App Store and Google Play and targets victims' cryptocurrency assets. The malware was found in modified TikTok apps and in a fake App Store page distributing iOS apps through Apple Enterprise provisioning profiles. The iOS version disguises a malicious module as AFNetworking.framework and, after gaining access to the photo gallery, uploads images to command-and-control servers, with a subset using OCR to select images of interest. The campaign has been active since at least February 2024, and Apple removed the malicious app from the App Store on 25.06.2025.