E-Business
Firm Discovers New Crypto-stealing Trojan in AppStore, Google Play
Kaspersky Threat Research expertise center has discovered a new data-stealing Trojan, SparkCat, active in AppStore and Google Play since at least March 2024. This is the first known instance of optical recognition-based malware appearing in AppStore.
SparkCat uses machine learning to scan image galleries and steal screenshots containing cryptocurrency wallet recovery phrases. It can also find and extract other sensitive data in images, such as passwords. Kaspersky has reported known malicious applications to Google and Apple.
How the new malware spreads
The malware is spreading through both infected legitimate apps and lures – messengers, AI assistants, food delivery, crypto-related apps, and more. Some of these apps are available on official platforms in Google Play and AppStore.
Kaspersky telemetry data also shows that infected versions are being distributed through other unofficial sources. In Google Play, these apps have been downloaded over 242,000 times.
Who is being targeted
The malware primarily targets users in the UAE and countries in Europe and Asia. This is what experts concluded based on both the information about the operational areas of the infected apps and the technical analysis of the malware.
SparkCat scans image galleries for keywords in multiple languages, including Chinese, Japanese, Korean, English, Czech, French, Italian, Polish, and Portuguese. However, experts believe victims could be from other countries as well.
How SparkCat works
Once installed, in certain scenarios the new malware requests access to view photos in a user’s smartphone gallery. It then analyses the text in stored images using an optical character recognition (OCR) module. If the stealer detects relevant keywords, it sends the image to the attackers.
The hackers’ primary goal is to find recovery phrases for cryptocurrency wallets. With this information, they can gain full control over a victim’s wallet and steal funds. Beyond stealing recovery phrases, the malware is capable of extracting other personal information from screenshots, such as messages and passwords.
“This is the first known case of OCR-based Trojan to sneak into AppStore,” said Sergey Puzan, malware analyst at Kaspersky. “In terms of both AppStore and Google Play, at the moment it’s unclear whether applications in these stores were compromised through a supply chain attack or through various other methods. Some apps, like food delivery services, appear legitimate, while others are clearly designed as lures.”
“The SparkCat campaign has some unique features that make it dangerous. First of all, it spreads through official app stores and operates without obvious signs of infection. The stealthiness of this Trojan makes it hard to discover it for both store moderators and mobile users.
Also, the permissions it requests seem reasonable, making them easy to overlook. Access to the gallery that the malware attempts to reach may seem essential for the app to function properly, as it appears from the user perspective. This permission is typically requested in relevant contexts, such as when users contact customer support,” added Dmitry Kalinin, malware analyst at Kaspersky.
Analysing Android versions of the malware, Kaspersky experts found comments in the code written in Chinese. Additionally, the iOS version contained developer home directory names, “qiongwu” and “quiwengjing”, suggesting that the threat actors behind the campaign are fluent in Chinese. However, there is not enough evidence to attribute the campaign to a known cybercriminal group.
ML-powered attacks
Cybercriminals are increasingly paying attention to neural networks in their nefarious tools. In the case of SparkCat, the Android module decrypts and executes an OCR-plugin using the Google ML Kit library to recognise text in stored images. A similar method was used in its iOS malicious module.
Nigerian Senate, on Tuesday, passed for first reading a bill aimed at amending the Nigerian Data Protection Act of 2023.
The amendment seeks to compel major social media platforms—including Facebook, X (formerly Twitter), Instagram, WhatsApp, YouTube, TikTok, and other independent bloggers—to establish physical offices in Nigeria.
The bill is titled “A Bill for an Act to Amend the Nigerian Data Protection Act, 2023, Mandating the Establishment of Physical Offices within the Federal Republic of Nigeria by Social Media Platforms, and for Related Matters, 2025.”
It was introduced by Senator Ned Nwoko, a lawmaker from Delta State.
The bill not only mandates that the social media platforms set up physical offices in Nigeria, but also seeks to regulate bloggers operating in the country.
It proposes that bloggers must establish verifiable offices in any Nigerian capital city, maintain proper employee records, and join a recognised association based in Abuja.
During the Senate debate, Nwoko highlighted Nigeria’s significant digital presence, referencing a report from Global Web Index shared by Business Insider Africa.
With a population of over 200 million, Nigeria ranks second globally in social media engagement.
Nwoko argued that having local offices is long overdue, noting that the absence of such offices creates challenges, including limited local representation and difficulties for users and businesses to engage directly with these platforms.
The Senate President, Godswill Akpabio, acknowledged the potential benefits of having these social media platforms establish local offices, particularly in terms of improving regulatory oversight and ensuring compliance.
However, Akpabio urged caution regarding the regulation of bloggers, stressing the importance of protecting online expression.
“It’s beneficial to have an address, but bloggers are a bit different. The best approach is for the bill to go for a second reading, followed by a public hearing to provide more clarity,” Akpabio said.
He emphasised that the intent of the bill was not to suppress social media, but rather to improve taxation and record-keeping for digital platforms in Nigeria.
The Senate has also tasked the Committee on ICT and Cyber Security to conduct a thorough review of the bill and report its findings in two months.
Google said Tuesday it will acquire cloud security platform Wiz for $32 billion, citing the need for greater cybersecurity capacity as artificial intelligence embeds itself in technology infrastructure.
The all-cash deal brings Wiz into the Google Cloud operation, boosting the capacity of consumers to use “multiple clouds” and providing “an end-to-end security platform for customers, of all types and sizes, in the AI era,” the companies said in a joint press release.
The deepening influence of AI makes “cybersecurity increasingly important in defending against emergent risks and protecting national security,” the companies said.
The transaction, the largest ever sought by Google or parent Alphabet, will test President Donald Trump’s openness to large takeovers after resistance to such deals by the administration of Joe Biden.
Alphabet had been close to a Wiz takeover last summer, but the deal fell apart due in part to regulatory concerns, according to the Wall Street Journal.
Started in 2020 by Assaf Rappaport, co-founder and CEO, and a team who sold a previous venture to Microsoft, Wiz will continue to work and provide services to platform led by other tech giants including Amazon Web Services and Microsoft Azure.
Wiz is based in New York, with offices in Tel Aviv and three other US cities.
In a webcast after the deal was announced, Rappaport said the service “continuously scans an organization’s code and cloud environments, monitoring them in real time” to “prioritize the most critical risk based on real impact and blocks active threats.”
Dare Olufunmilayo, founder and CEO of Darey.io, has said that the reason for the establishment of a physical tech hub in Lagos is to expand on the digital talents they have started building especially pushing its artificial intelligent initiatives further.
Speaking at the launch of the hub, he described the moment as more than just the opening of a new office but the beginning of a transformative movement.
“Today is not just about celebrating a new office space; it is about launching a movement, a revolution in how we learn, build careers, and create opportunities in the tech ecosystem,” he stated.
The event’s theme, “Tech & Tea: Brewing Nigeria’s Technology Innovation Future,” reflects the belief that building a thriving digital economy requires the right mix of talent, innovation, and collaboration.
Olufunmilayo likened the process to brewing the perfect cup of tea, requiring the right mix of talent, innovation, and partnerships.
“Just like brewing the perfect tea, building a thriving digital economy requires the right ingredients: talent, innovation, and collaboration,” he noted.
He also acknowledged the critical role of various stakeholders, including the Nigerian government, tech leaders, and industry partners.
“None of this would be possible without the ecosystem we are a part of. The government’s 3MTT initiative is playing a crucial role in creating a future-ready workforce,” he said, recognizing the contributions of government efforts, partners, and the dedicated Darey.io team.
Reflecting on the journey that led to this milestone, Olufunmilayo highlighted the company’s mission to empower Africans with world-class digital skills and bridge the gap between talent and opportunity.
“A few years ago, we started with a bold vision: to empower Africans with world-class digital skills and bridge the gap between talent and opportunity.
“We believed that, with the right platform, the right training, and the right mindset, anyone—no matter their background—could go from learning to earning in the global digital economy.”
That vision, he emphasized, has now become a reality. “Thousands of Nigerians have started their careers through Darey.io, working for top global companies, launching startups, and creating ground-breaking solutions.”
With the launch of Xterns.ai, the initiative is taking an even greater leap forward. “Xterns.ai is our next big leap—where we don’t just train talents; we integrate them directly into the workforce through our Proof-of-Skills Hiring model,” Olufunmilayo explained.
Speaking at the launch, Francis Sani, Technical Adviser for Innovation, Entrepreneurship, and Capital to the Minister of Communications, Innovation, and Digital Economy, highlighted Nigeria’s demographic advantage.
He noted that Nigeria has the largest youth population in Africa, with a median age of 16 years, compared to 38 in the U.S. and 46 in Japan. This, he said, positions the country as a key player in the global tech competitiveness race.
However, Sani emphasized that access to quality training and employment pathways remains a significant challenge. “We have the talent, we have the ambition, but we must scale up digital skills to compete globally,” he stated.
Senate Votes to Compel Facebook, Others to Open Offices in Nigeria
Google to Buy Cybersecurity Company Wiz for $32Bn
MTN Group to Invest $10Bn in African Expansion by 2030
ATCON Calls for Telecom Policy Improvements in Nigeria
9mobile Reinforces Innovation Leadership with Echoes, Its Trailblazing AI Storytelling Platform
General News2 days agoJumia Nigeria Kicks Off Tech Week 2025
Telecom2 days agoBridging Nigeria’s Digital Divide: ITU and UK-FCDO Fuel Rural Connectivity Revolution
E-Financial2 days agoSEC Voids Mainland Trust’s Registration, Suspends Centurion Registrars
E-Business2 days agoNITDA Expands iHATCH Initiative to Drive Job Creation, Economic Diversification
Telecom2 days agoTransforming Lives Through Advocacy: Princess Omoyemwen Inspires Change at MTN’s Go MAD Activation in Benin
E-Financial1 day agoCentral Bank Defends Naira with $360m in 5-Day
Telecom1 day agoMTN’s Earnings Hammered by Free Falling Naira in Nigeria
E-Business1 day agoFG Partners Cyberpedia to Fight Misinformation with AI