Kaspersky Confirms 'SparkCat' Variant Bypassing App Store and Google Play
Published2026.04.27 10:25
Scan the photo gallery disguised as a legitimate app
Search for cryptocurrency recovery phrases with OCR
Kaspersky announced on April 27 that its threat research team identified two infected apps on the App Store and one on Google Play. SparkCat was rediscovered in a variant form about a year after being removed from both major app platforms.
This variant was distributed disguised as legitimate applications, such as enterprise messengers and food delivery apps. If a user grants permission to access photos, it checks images in the device's gallery and analyzes the characters contained within them using an Optical Character Recognition (OCR) module. The structure is designed to transmit the corresponding image to the attacker if relevant keywords are detected.
The search targets varied by platform. The Android variant was designed to find screenshots containing Japanese, Korean, and Chinese keywords. Based on this, Kaspersky analyzed that this campaign was primarily aimed at cryptocurrency users in Asia. The iOS variant searches for wallet recovery phrases written in English, potentially affecting users without regional restrictions.
Technically, methods that make detection more difficult than before have been applied. The latest Android variants include multi-layered obfuscation structures, code virtualization, and the use of cross-platform programming languages. Kaspersky explained that these techniques are uncommon in mobile malware.
Kaspersky reported the identified malicious app to Google and Apple, and the app has now been removed from the official stores. However, distribution through third-party channels was also confirmed, and some web pages were found to be disguised by displaying a screen similar to the App Store to iPhone users.
Security experts advise against saving images containing cryptocurrency wallet recovery phrases or personal authentication information on smartphones. When installing apps, check the source and the scope of permission requests, and for apps requesting photo access, verify whether it is actually necessary for their functionality.
관련뉴스
Kaspersky Launches UEBA-Based SIEM Solution
Kaspersky has announced a SIEM solution that integrates a UEBA rule set. Through machine learning-based behavioral analytics, it detects anomalies in real-time and minimizes false positives, enhancing security response capabilities.
2025.10.22by 명세환 기자
Honeymite APT targets government agencies, evolving information theft techniques.
카스퍼스키가 정부 및 외교 기관을 겨냥한 허니마이트(HoneyMyte) APT의 최신 공격 흐름을 공개했다. 분석 결과, 공격자는 CoolClient 백도어 기능을 확장해 클립보드와 활성창 정보, 브라우저 로그인 데이터, HTTP 프록시 자격 증명 등을 수집한 것으로 나타났다. 감염 과정에는 정상 서명된 실행 파일이 악성 DLL을 로드하도록 유도하는 DLL 사이드로딩 기법이 활용됐고, 최근 캠페인은 미얀마·몽골·말레이시아·태국·러시아 등에서 확인됐다. 연구진은 능동적 감시 기능이 APT 공격의 표준 전술로 자리 잡고 있어 선제적 방어가 필요하다고 평가했다.
2026.02.04by 명세환 기자
Notepad++ Supply Chain Attack: 3 Additional Undisclosed Infection Chains Confirmed
Kaspersky's Global Research and Analysis Team analyzed a recent Notepad++ supply chain attack and revealed that the attackers targeted Philippine government agencies, Salvadoran financial institutions, Vietnamese IT service providers, and individual users across multiple countries. A minimum of three infection chains were used in the attack, two of which had not been previously disclosed. Notably, the attack infrastructure utilized from July to September 2025 differed significantly from previously known indicators of compromise, raising the possibility that some organizations may not have been aware of their infections. Kaspersky explained that there may be additional, as yet unconfirmed attack stages.
2026.02.09by 명세환 기자
Kaspersky Unveils Revamped 'NEXT' Combining SOC Integrated Management and AI Analytics
기업들이 보안관제센터(SOC) 구축과 운영에서 통합 관리와 자동화 수요를 키우는 가운데, 카스퍼스키가 자사 B2B 보안 제품군 ‘카스퍼스키 넥스트’의 개편 내용을 공개했다. 이번 업데이트는 OSMP 기반 단일 콘솔로 EPP·EDR·XDR·SIEM 연계를 넓히고, DLL 하이재킹 탐지와 계정 탈취 의심 행위 식별 같은 AI 기능, 생성형 AI 보조도구 KIRA 연동을 담았다. 회사는 대규모 배포 환경에서 EDR Expert는 최대 30%, XDR Expert는 최대 60%까지 자원 요구량을 낮출 수 있다고 밝혔다.
2026.03.25by 배종인 기자
Kaspersky to Rank #1 in Most Global Independent Security Assessments by 2025
카스퍼스키가 2025년 한 해 글로벌 독립 보안 테스트와 리뷰 100건에 참여해 90건에서 1위를 기록했다고 1일 밝혔다. 기업용 EDR, 엔드포인트 보안, 중소기업용 보안, 개인용 보안 제품군 전반에서 인증과 수상이 이어졌으며, 장기 누적 기준으로도 2013년부터 2025년까지 1122건의 평가 중 861건에서 1위를 차지했다고 설명했다. 이번 결과는 보안 제품 평가 기준이 탐지율뿐 아니라 오탐률, 사용성, 고급 위협 대응 역량까지 확대되고 있음을 보여준다.
2026.04.01by 배종인 기자
