Malware With Screen Reading Code Found in iOS Apps for the First Time

[MacRumors]

Malware that includes code for reading the contents of screenshots has been found in suspicious App Store apps for the first time, according to a report from Kaspersky.

Dubbed "SparkCat," the malware includes OCR capabilities for sussing out sensitive information that an iPhone user has taken a screenshot of. The apps that Kaspersky discovered are aimed at locating recovery phrases for crypto wallets, which would allow attackers to steal bitcoin and other cryptocurrency.

The apps include a malicious module that uses an OCR plug-in created with Google's ML Kit library to recognize text found inside images on an iPhone. When a relevant image of a crypto wallet is located, it is sent to a server accessed by the attacker.

According to Kaspersky, SparkCat has been active since around March 2024. Similar malware was discovered in 2023 that targeted Android and PC devices, but it has now spread to iOS. Kaspersky located several App Store apps with OCR spyware, including ComeCome, WeTink, and AnyGPT, but it is not clear if the infection was a "deliberate action by the developers" or the "result of a supply chain attack."

The infected apps ask for permission to access a user's photos after being downloaded, and if granted permission, use the OCR functionality to sort through images looking for relevant text. Several of the apps are still in the App Store, and seem to be targeting iOS users in Europe and Asia.

While the apps are aimed at stealing crypto information, Kaspersky says that the malware is flexible enough that it could also be used to access other data captured in screenshots, like passwords. Android apps are impacted as well, including apps from the Google Play Store, but iOS users often expect their devices to be malware resistant.

Apple checks over every app in the App Store, and a malicious app marks a failure of Apple's app review process. In this case, there does not appear to be an obvious indication of a trojan in the app, and the permissions that it requests appear to be needed for core functionality.

Kaspersky suggests that users should avoid storing screenshots with sensitive information like crypto wallet recovery phases in their Photo Library to stay safe from this kind of attack.

A full list of iOS frameworks that are infected is available on the Kaspersky website, along with more information about the malware.

Article Link: Malware With Screen Reading Code Found in iOS Apps for the First Time

 

[sniffies]

I wish Apple Intelligence were intelligent enough to detect and exterminate malware.

But we have genmoji. Yay.

 

[sw1tcher]

Malware that includes code for reading the contents of screenshots has been found in suspicious App Store apps for the first time, according to a report from Kaspersky.

Kaspersky located several App Store apps with OCR spyware, including ComeCome, WeTink, and AnyGPT...

See. This is what happens when you allow 3rd party app stores.

What's that? This was found on Apple's App Store? 😲

 

[10anta]

Time to upgrade the code checking

 

[Mrkevinfinnerty]

Impossible. Apple would not approve an app unsafe for the kids. 🍼

 

[thefrost]

Dubbed "SparkCat," the malware includes OCR capabilities for sussing out sensitive information that an iPhone user has taken a screenshot of. The apps that Kaspersky discovered are aimed at locating recovery phrases for crypto wallets, which would allow attackers to steal bitcoin and other cryptocurrency.

Cats stealing crypto? Didn't know cats could be so dangerous.

 

[nt5672]

"Apple checks over every app in the App Store. . . ."

They'd like you to think that, but no they do NOT check every app. Apple are more interested in nanny rules than real security rules. That is not to say they won't fix this, because they almost always respond after the fact when the media holds them accountable.

That is exactly why there is no such thing as "security by obscurity." And also why 3rd party App stores should be allowed. There is no additional security provided by Apple's walled garden. Marketing at its finest.

 

[Havalo]

Curiosity caught the cat 🤷🏻‍♂️

 

[mdnz]

See. This is what happens when you allow 3rd party app stores.

What's that? This was found on Apple's App Store? 😲

You mean.... restricting 3rd party app stores was for Apple's bottom line all along? Nooooo they would never do that!

 

[GMShadow]

"Apple checks over every app in the App Store. . . ."

They'd like you to think that, but no they do NOT check every app. Apple are more interested in nanny rules than real security rules. That is not to say they won't fix this, because they almost always respond after the fact when the media holds them accountable.

That is exactly why there is no such thing as "security by obscurity." And also why 3rd party App stores should be allowed. There is no additional security provided by Apple's walled garden. Marketing at its finest.

Those of us who weren't born yesterday know they used to run deeper checks, and developers and the media screamed about how it took too long, and how Apple was evil, and how they needed to be regulated.

So they gave people what they demanded - faster screening times. And now we get this, and people still complain, because people who don't understand anything scream the loudest about everything.

 

[miric]

Kaspersky is the FSB sh.t.

 

[jole]

Storing your wallet keys as a picture in photo library (hosted on a cloud service) — what a great idea!

Why not share a backup copy here as well?

Here is mine: level board tiny alone exhaust green erase north gym enact foster nurse awake foster divert cup invite color author lawn else solution start aspect

 

[nt5672]

Those of us who weren't born yesterday know they used to run deeper checks, and developers and the media screamed about how it took too long, and how Apple was evil, and how they needed to be regulated.

Having Apps in the App Store since the beginning I will never believe the earlier delays were for deeper checks. The delay was because they wanted the developers to think there were deeper checks, but the times my apps were delayed were for stupid reasons and almost always because the reviewer had no idea what they were doing.

 

[Jashar7]

Malware that includes code for reading the contents of screenshots has been found in suspicious App Store apps for the first time, according to a report from Kaspersky.

Dubbed "SparkCat," the malware includes OCR capabilities for sussing out sensitive information that an iPhone user has taken a screenshot of. The apps that Kaspersky discovered are aimed at locating recovery phrases for crypto wallets, which would allow attackers to steal bitcoin and other cryptocurrency.

The apps include a malicious module that uses an OCR plug-in created with Google's ML Kit library to recognize text found inside images on an iPhone. When a relevant image of a crypto wallet is located, it is sent to a server accessed by the attacker.

According to Kaspersky, SparkCat has been active since around March 2024. Similar malware was discovered in 2023 that targeted Android and PC devices, but it has now spread to iOS. Kaspersky located several App Store apps with OCR spyware, including ComeCome, WeTink, and AnyGPT, but it is not clear if the infection was a "deliberate action by the developers" or the "result of a supply chain attack."

The infected apps ask for permission to access a user's photos after being downloaded, and if granted permission, use the OCR functionality to sort through images looking for relevant text. Several of the apps are still in the App Store, and seem to be targeting iOS users in Europe and Asia.

While the apps are aimed at stealing crypto information, Kaspersky says that the malware is flexible enough that it could also be used to access other data captured in screenshots, like passwords. Android apps are impacted as well, including apps from the Google Play Store, but iOS users often expect their devices to be malware resistant.

Apple checks over every app in the App Store, and a malicious app marks a failure of Apple's app review process. In this case, there does not appear to be an obvious indication of a trojan in the app, and the permissions that it requests appear to be needed for core functionality.

Kaspersky suggests that users should avoid storing screenshots with sensitive information like crypto wallet recovery phases in their Photo Library to stay safe from this kind of attack.

A full list of iOS frameworks that are infected is available on the Kaspersky website, along with more information about the malware.

Article Link: Malware With Screen Reading Code Found in iOS Apps for the First Time

This is EU fault.

 

[litmag01]

Kaspersky. Heh. Go figure.

 

[turbineseaplane]

Even the ones getting scanned by Apple’s world class protection that everyone is counting on?

 

[turbineseaplane]

Apple checks over every app in the App Store. . . .

To make sure you’re not violating any of their draconian business terms

 

[CoMoMacUser]

iPhones must not be niche products. Otherwise, hackers would not waste time and resources targeting a small group of potential victims. 🤔

 

[fabbydabby1]

Those of us who weren't born yesterday know they used to run deeper checks, and developers and the media screamed about how it took too long, and how Apple was evil, and how they needed to be regulated.

So they gave people what they demanded - faster screening times. And now we get this, and people still complain, because people who don't understand anything scream the loudest about everything.

Well why commit to something if you can’t regulate it properly. Surely you know as a company that you can still maintain your standards before you make it quicker.
So your basically saying they cut corners in the process so that is Apple’s fault

 

[Radeon85]

How's that walled garden working for you Apple? 😄

 

[TechWhisperer]

All your base are belong to us.

 

[Mrkevinfinnerty]

To make sure you’re not violating any of their draconian business terms

Not just that, they check if they want to rip it off too.

 

[now i see it]

Kaspersky located several ‌App Store‌ apps with OCR spyware

this is just the tip of the iceberg.
Probably the number one disservice A-Inc has propagated though out the history of iOS is that it is secure.

HA!

 

[Aeronauts]

How's that walled garden working for you Apple? 😄

I think we all know the walled garden is there to increase their profits rather protect their customers.

 

[turbineseaplane]

Not just that, they check if they want to rip it off too.

“nice looking crown icon you got there…”