SparkCat is a mobile malware identified in 2024, capable of automatically extracting sensitive data from screenshots stored on Android and iOS devices. Leveraging optical character recognition (OCR) mechanisms, it represents a stealthy and targeted threat, able to bypass traditional protections by legitimately exploiting granted application permissions.
Application Infection Vectors and Abuse of Mobile Permissions
The infection chain relies on the distribution of seemingly benign applications, offered on official app stores or acquired via sideloading. These applications request access to media files (photo library, screenshots) under functional pretexts such as user support or personalization. Once these permissions are granted, SparkCat can access screenshots and initiate its analysis process.
Automated Visual Analysis and Embedded OCR Extraction
SparkCat embeds an analysis engine based on optical character recognition libraries, deployed in Rust on iOS and Java on Android. It scans images to detect critical text information such as recovery phrases, credentials, two-factor authentication codes, or banking details.
The extracted data is filtered, locally compressed, and then exfiltrated to command-and-control servers via encrypted connections, typically HTTPS.
Persistence and Evasion Techniques Observed on iOS and Android
The malware executes in the background through standard system processes. Network activity is minimal and segmented into small encrypted packets, blending exfiltration into standard mobile application traffic. SparkCat avoids system notifications, visible logs, or resource spikes that could alert a vigilant user or a mobile EDR solution.
SparkCat Malware Process
MITRE ATT&CK for Mobile Techniques Mapping
SparkCat aligns with several techniques documented in the MITRE ATT&CK framework:
-
T1477: Initial access via infected application
-
T1204: Execution based on user interaction (permissions)
-
T1560: Local data collection (screenshots)
-
T1056.001: Text capture via OCR
-
T1041: Exfiltration via HTTPS protocol
This mapping facilitates the modeling of attack scenarios in detection and response systems.
Indicators of Compromise (IOCs) and Detection via YARA Rules
Several domains associated with SparkCat have been identified, including googleapps.top, aliyung.com, and appleapi.dev. These infrastructures, active since late 2023, act as Command and Control (C2) servers for the malware.
The generated traffic exhibits very low volumes and regular intervals, making it difficult to detect without behavioral analysis.
Defensive Approach: Mitigation Measures and Monitoring Strategies
Defending against SparkCat relies on combining technical controls with behavioral monitoring. We recommend to:
-
Systematically restrict media access for third-party applications,
-
Audit active permissions across mobile fleets, particularly those related to screenshots,
-
Implement network alerts for identified domains or anomalous communication patterns,
-
Monitor repeated access to screenshot directories via MDM or mobile EDR solutions.
Behavioral detection platforms, such as SIEM XDR Reveelium, can provide an additional detection layer in high-risk environments.
Conclusion
SparkCat introduces an original approach to data theft by targeting visual elements generated by the user rather than raw files or keystrokes. This focus on screenshots, combined with local processing techniques and stealthy exfiltration, grants it high operational efficiency.
Faced with this type of threat, traditional security methods are insufficient. Prevention relies on hardening permission policies, in-depth behavioral monitoring, and adopting specialized solutions engineered to detect emerging mobile threats.
