Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new spyware campaign dubbed SparkKitty has been discovered targeting both iOS and Android devices. The malware, believed to be connected to the previously identified SparkCat campaign, is distributed through official app stores and unofficial sources. It primarily steals photos from infected devices, likely searching for cryptocurrency wallet information. The campaign has been active since at least February 2024 and mainly targets users in Southeast Asia and China. The malware is embedded in various apps, including modified versions of popular applications like TikTok, and uses different techniques to evade detection. The researchers identified multiple variations of the malware, including obfuscated libraries and malicious frameworks mimicking legitimate ones.

The SparkKitty Trojan is a spyware campaign targeting both iOS and Android mobile devices, discovered to be active since at least February 2024. It is believed to be linked to the earlier SparkCat campaign. The malware is distributed through both official app stores (Apple App Store and Google Play) and unofficial sources, increasing its reach and infection vectors. SparkKitty is embedded within various applications, including modified versions of popular apps such as TikTok, which helps it evade detection by masquerading as legitimate software. The malware employs obfuscated libraries and malicious frameworks that mimic legitimate ones, complicating detection and analysis efforts. Its primary objective is to steal photos from infected devices, with a likely focus on extracting cryptocurrency wallet information, which is often stored as images or QR codes. The campaign mainly targets users in Southeast Asia and China, but the presence in official app stores implies potential for wider distribution. The malware uses techniques consistent with known tactics such as user execution (T1204.002), input capture (T1056), and malicious code injection or framework manipulation (T1176). Despite its medium severity rating, the campaign's persistence, multi-platform targeting, and use of legitimate distribution channels make it a significant threat to mobile users. No known exploits in the wild have been reported beyond the malware's distribution itself, and no specific affected versions are listed, indicating a broad potential impact across device models and OS versions.

Detailed information about The new SparkKitty Trojan spy in the App Store and Google Play. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'southeast asia'

Filter Threats

Threats Tagged 'southeast asia'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility