Apps distributed through both Apple and Google’s app stores are hiding malicious screenshot-reading code that’s being used to steal cryptocurrency, according to Kaspersky.
Kaspersky discovered the code for this malware campaign, named "SparkCat," in late 2024.
Several App Store apps, including ComeCome, WeTink, and AnyGPT, were found to contain OCR spyware, which led to Apple pulling the apps from the App Store.
It is unclear whether the infection was a deliberate action by the developers or the result of a supply chain attack.