Beware of theft! Popular Android and iOS apps are secretly embedded with malicious software to steal wallet mnemonics

Security firm Kaspersky Labs warned on Tuesday that it had found dozens of apps in the Google and Apple mobile app stores that concealed malware that could scan images with optical character recognition (OCR) to find encryptionWallet mnemonics. (Summary: Vitalik criticizes the market for "smart wallet": most are centrally controlled, users must be careful of malicious risks) (Background added: piracy is rampant: beware of dangerous traps hidden by the App Store) Kaspersky Labs, a well-known Russian information security company, warned in its latest report on the 4th that they are in Google and Apple The mobile app's software development kit found images that could be scanned using optical character recognition (OCR) models, using keywords in different languages to search for mnemonic words (recovery phrases) from CryptocurrencyWallet, and then stealing malware from the funds. The company named the malware SparkCat and said it was the first known case of stealing software into Apple's App Store. It estimates that the malware has been downloaded about 242,000 times on Google Play since it became active around March 2024, mainly targeting Android and iOS users in Europe and Asia, but does not rule out the possibility of users in other regions being victimized. Google and Apple App Store Hidden Malware-Containing Apps: Fear of Stealing EncryptionWallet Mnemonic Kaspersky said: "We were able to determine the attacker's motive, which was to steal the phrase to restore access to encryptionWallet, which was enough to take full control of the victim's Wallet to further steal funds." Notably, the Malware's flexibility allows it to steal not only recovery phrases, but also other personal data in the gallery, such as message content or passwords that may remain on screenshots." Kaspersky analysts advise users not to store screenshots containing sensitive information in their phone's gallery, but instead to store passwords, confidential documents and other sensitive data using special applications such as password managers. They also call for the removal of any suspicious or infected applications. Named as the suspected malware app "ComeCome", a food delivery app for the UAE and Indonesia. Source: Kaspersky Labs once again shatters the security myth of Apple's iOS apps Kaspersky warns that the malware is particularly dangerous because there is no indication that there is a malicious implant inside the app, that the permissions it requests may be used for the main function of the app, or that at first glance seem harmless, and that the malware operates quite hidden. The case once again shattered the myth that the threat posed by the Android malicious app has nothing to do with iOS. According to their investigation, the malware exists in dozens of apps in the Google and Apple App Stores, both real and fake, but they all have something in common, such as the use of the Rust language, which is "rare in mobile apps", cross-platform features, and obfuscation features, which makes analysis and detection difficult. The report adds that it remains unclear whether the affected applications "were infected as a result of the supply chain attack or if the developers deliberately embedded Trojans in them." Some malware-containing apps, such as delivery services, appear legitimate, but others are clearly built to lure victims, for example, there are several similar "messaging apps" with AI capabilities from the same developer. Analysts point out that the source of the malware is unclear and cannot be attributed to any known organization, however, they did find comments and error descriptions written in Chinese in the code, which gave them reason to believe that "the developers of this malware are fluent in Chinese." Other popular apps that have been accused of containing malware. Source: Kaspersky Labs related report Beware of fake recruitment attacks! North Korean hackers ( Lazarus ) new malicious virus evades detection Warning! Apple Store's latest malicious phishing APP, turning on two-factor authentication may still be stolen Browser Currency Theft: Chrome Extension Theft Event Analysis 〈Beware of theft! Android, iOS popular APP explosion hidden malware steals Wallet mnemonic" This article was first published in BlockTempo's "Dynamic Trend - The Most Influential Block Chain News Media".