--- title: "SparkCat: Proof That iOS Is Not Immune to Malware" description: Researchers have recently discovered SparkCat, a malware that targets smartphone users by exploiting their screenshots to extract sensitive data image: https://blog.pradeo.com/hubfs/Design%20sans%20titre%20(11).png --- [![pradeo\_logo\_color](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_color.png?width=220&height=33&name=pradeo_logo_color.png "pradeo_logo_color")](https://pradeo.com) - Solutions - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/) - [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/) - [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/) - [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - Use cases - [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/) - [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Ensuring compliance for applications](https://pradeo.com/en/compliance/) - [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/) - [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Become partner](https://pradeo.com/become-partner/) - Resources - [Solution briefs](https://pradeo.com/en/resources/?solution-briefs) - [Customer Cases](https://pradeo.com/en/resources/?customer-cases) - [Integration briefs](https://pradeo.com/en/resources/?integration-briefs) - [White Papers](https://pradeo.com/en/resources/?white-papers) - [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides) - [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand) - [About us](https://pradeo.com/en/about/) - [Blog](https://blog.pradeo.com/) - [Contact](https://pradeo.com/contact/) - en - [**FR**](https://blog.pradeo.com/fr) - [**DE**](https://blog.pradeo.com/de) ### Topics - Select a Topic ### Stay up to date SUBSCRIBE TO OUR BLOG ### Stay up to date [News](https://blog.pradeo.com/topic/news) # SparkCat: Proof That iOS Is Not Immune to Malware ![Picture of Clara Campos](https://blog.pradeo.com/hubfs/1711636314862%20(1).jpg) By [Clara Campos](https://blog.pradeo.com/author/clara-campos) on March, 7 2025 [mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article) ![](https://blog.pradeo.com/hubfs/Design%20sans%20titre%20(11).png) Researchers have recently discovered SparkCat, a malware that targets smartphone users by exploiting their screenshots to extract sensitive data. This malicious program was recently detected in applications [available on the App Store](https://www.bleepingcomputer.com/news/mobile/crypto-stealing-apps-found-in-apple-app-store-for-the-first-time/) and Google Play, highlighting the limitations of these platforms’ security controls.    ## A Sophisticated Malware That Exploits Screenshots  SparkCat infiltrates mobile devices by hiding within apps downloaded from the App Store or Google Play. Once installed, the malicious app requests access to photos under a seemingly legitimate pretext, such as image customization or media file sharing. As soon as permission is granted, it discreetly scans the folder where users’ screenshots are stored.  The image analysis then begins. SparkCat uses Optical Character Recognition (OCR) to identify sensitive elements, primarily cryptocurrency wallet recovery phrases, but also login credentials and authentication codes. The extracted data is then sent to a remote server controlled by cybercriminals, allowing them to access victims’ financial accounts and drain them.  But the malware doesn’t stop there. By exploiting granted permissions, it intercepts SMS messages and notifications, retrieving two-factor authentication codes. This allows it to bypass security measures put in place by victims and gain access to protected accounts. To ensure its persistence, SparkCat employs advanced obfuscation techniques, making it difficult to detect and remove.    ## Compromised Applications on Official Stores  SparkCat is particularly insidious because it turns legitimate applications into infection vectors. It has spread through official stores by integrating into legitimate applications that provide popular services, such as AI assistants, food delivery apps, and cryptocurrency wallets.  The malware injection occurs through SDKs and frameworks, which are often integrated by developers unaware of their malicious nature, thereby compromising the security of their applications and end users.  On Android, the malicious SDK includes a Java component named Spark, disguised as a data analysis module. On iOS, it appears under various names, including Gzip, googleappsdk, or stat. Malicious applications identified include WeTink, AnyGPT, and ComeCome.    ## How to Protect Yourself Against This Malware?  To counter SparkCat, follow these security best practices:  - **Restrict permissions**: Limit access to sensitive resources, such as the photo gallery, only to strictly necessary applications. - **Monitor app permissions**: Regularly audit the access granted to applications and revoke those that seem unjustified or do not comply with the company’s security policies. - **Deploy an advanced mobile security solution**: [Pradeo Mobile Threat Defense (MTD)](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/?utm_medium=ppc) provides unmatched accuracy in analyzing app behavior. It detects not only when an application attempts to access stored files but also when it exfiltrates data to a remote server. Thanks to this precise detection capability, applications containing SparkCat are automatically blocked by Pradeo, preventing any sensitive data leakage before it can occur. ###### About The Author [More from this author](https://blog.pradeo.com/author/clara-campos) ![](https://blog.pradeo.com/hs-fs/hubfs/1711636314862%20(1).jpg?height=100&name=1711636314862%20(1).jpg) ###### Clara Campos #### Recommended articles [![Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/hubfs/Template%20article%20(40).png)](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1) ###### [Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1) \- September 1, 2026 [![RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/hubfs/Template%20article%20(37)-2.png)](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) ###### [RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) \- July 23, 2026 [![What Google's latest report reveals about mobile threats](https://blog.pradeo.com/hubfs/Template%20article%20(35)-1.png)](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) ###### [What Google's latest report reveals about mobile threats](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) \- July 10, 2026 ### Popular articles ### Stay up to date ### Recent articles ### Articles récents [Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1) \- 7 March, 2025 [RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) \- 7 March, 2025 [What Google's latest report reveals about mobile threats](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) \- 7 March, 2025 [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) \- 7 March, 2025 [Vibe Coding: when AI-generated code multiplies vulnerabilities](https://blog.pradeo.com/vibe-coding-when-ai-generated-code-multiplies-vulnerabilities) \- 7 March, 2025 ### Topics - [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security) - [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security) - [Expertise (31)](https://blog.pradeo.com/topic/expertise) - [Security Alert (30)](https://blog.pradeo.com/topic/security-alert) - [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity) - [News (28)](https://blog.pradeo.com/topic/news) - [Partners (25)](https://blog.pradeo.com/topic/partners) - [Corporate (12)](https://blog.pradeo.com/topic/corporate) - [Events (4)](https://blog.pradeo.com/topic/events) - [Actualité (2)](https://blog.pradeo.com/topic/actualité) - [predictions (2)](https://blog.pradeo.com/topic/predictions) - [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack) see all [![New Call-to-action](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f) ### Get in touch with mobile security experts [Contact us](https://www.pradeo.com/en-US/contact-us) [![](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_white_square.png?width=90&height=74&name=pradeo_logo_white_square.png)](https://pradeo.com) European leader in mobile security, Pradeo protects business mobile devices and applications. [Read More](https://www.pradeo.com/en-US/) - [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers) - [UEM security](https://www.pradeo.com/en-US/uem-mdm-security) - [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case) - [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation) - [Contact us](https://www.pradeo.com/en-US/contact-us) - [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense) - [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing) - [In-App Protection](https://www.pradeo.com/en-US/in-app-protection) - [Secure Private Store](https://www.pradeo.com/en-US/private-app-store) - [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence) ![email.svg](https://cdn2.hubspot.net/hubfs/3067823/awwal/email.svg "email.svg") [contact@pradeo.com](mailto:contact@pradeo.com) Copyright @ 2022. All Right Reserved. - - - ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Clara Campos" }, "dateModified" : "March 13, 2025, 2:46:23 PM", "datePublished" : "2025-03-07 10:35:01", "description" : "Researchers have recently discovered SparkCat, a malware that targets smartphone users by exploiting their screenshots to extract sensitive data", "headline" : "SparkCat: Proof That iOS Is Not Immune to Malware", "image" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-na1.net/hubfs/2378615/Design%20sans%20titre%20%2811%29.png" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg" }, "name" : "Pradeo" } } ```