Millions of users at risk: Apple and Google removed over 20 apps that stole cryptocurrency passwords

Apple and Google have removed up to 20 apps that contained malware designed to steal users' cryptocurrency passwords, TechCrunch reports. We tell you the details.

What happened

Apple and Google removed up to 20 apps that contained malware capable of stealing user data, including passwords to cryptocurrency wallets.

The malware, dubbed SparkCat, was discovered in March 2024 by Kaspersky researchers. They first found it in a food delivery app used in the United Arab Emirates and Indonesia, but later found the malware in 19 other unrelated apps.

In total, these apps were downloaded more than 242,000 times through the Google Play Store and App Store. The attackers used code to read text on the user’s screen, including optical character recognition (OCR) technology, to find phrases to recover cryptocurrency wallets on victims’ devices.

The malware was found to support multiple languages, including English, Chinese, Japanese, and Korean. After receiving the researchers’ report, Apple and Google quickly removed the malware. However, researchers noted that this software is also available through other sites and unofficial app stores.