A new cross-platform malware dubbed SparkKitty has been discovered on both Apple's App Store and Google Play, targeting cryptocurrency users by scanning photos for wallet recovery phrases.

Instead of monitoring your clipboard or keystrokes, SparkKitty uses OCR (Optical Character Recognition) to search your photo gallery for seed phrase screenshots, passwords, QR codes, and other sensitive data before sending them to attacker-controlled servers.

Researchers found the malware hidden inside fake crypto, messaging, and entertainment apps, with one Android app surpassing 10,000 downloads before removal.