Safeguard Your Phone Against Photo Stealing Malware Such as SparkKitty

In the digital age, many individuals are increasingly storing sensitive information in photo formats, including important data such as crypto seed phrases, primary passwords for password managers, and recovery codes for authenticators. However, rising threats from malicious software, particularly advanced strains like the SparkKitty malware, have emerged to compromise this information. This article will outline effective strategies to safeguard your sensitive images against such malicious threats.

Understanding SparkKitty Malware

SparkKitty is an evolution of the earlier photo-stealing malware known as SparkCat. Unlike its predecessor, which specialized in targeting specific images such as crypto seed phrases through Optical Character Recognition (OCR), SparkKitty poses a greater risk by indiscriminately uploading all the images from a device to its command and control (C2) server. This broader targeting makes it significantly more perilous.

Beyond merely compromising recovery codes and passwords, the stolen images can be exploited for various malicious activities, including blackmail, identity theft, and even intricate social engineering attacks. One of the most concerning aspects of SparkKitty is its stealth; it often spreads through seemingly legitimate applications by leveraging default media permissions. Although prevalent in third-party app stores, instances of infected applications have also appeared in official app marketplaces, including those linked to apps like Soex and 币coin, which have since been removed.

How to Secure Sensitive Photos

Your initial line of defense against photo-stealing malware is to store sensitive images in a protected environment. Here are two effective methods to achieve this:

1. Utilize Google Photos’ Locked Folder

If you use Google Photos for storage, consider leveraging the Locked Folder feature, which creates an encrypted vault for your images. By moving sensitive photos to this folder, they will be removed from your main gallery and stored securely online.

To transfer photos: open the desired image in Google Photos, tap the Add to button at the bottom, and select the Locked Folder. The first time you use this feature, a quick setup is required. To access your Locked Folder, navigate to Collections and click on Locked, using your device’s unlock method for access.

Demonstration of adding a photo to the Locked Folder in Google Photos

2. Employ a Third-Party Photo Vault App

If you prefer to avoid cloud storage or want to keep your images offline, a third-party photo vault app can be highly effective. An excellent option is Keepsafe Photo Vault, available for both Android and iOS. This app encrypts your media with either a dedicated PIN or biometric lock, providing an extra layer of security. Additionally, it offers a feature to disguise the app icon, further concealing it from unauthorized users.

Note that Keepsafe defaults to syncing photos to the cloud, so be sure to turn off the Backup & Sync feature if you require an offline vault.

Keepsafe Photo Vault main interface and settings

Managing App Permissions

Since SparkKitty needs access to your photos for its operation, it is crucial to regularly audit app permissions on your phone. This ensures that only trusted and necessary applications have access to your sensitive media.

For Android users, navigate to Settings -> Privacy Protection -> All Permissions -> Photos and Videos.

For iOS users, proceed to Settings -> Privacy & Security -> Photos.

Here, verify that only reputable applications are permitted access. If an app appears suspicious or does not require media permissions for its core functionalities, revoke its access.

App permissions list on Android showing apps with media access

Steering Clear of Apps Associated with SparkKitty

Kaspersky researchers have identified various kinds of applications frequently associated with the SparkKitty malware. To minimize the risk, avoid downloading these apps, whether from third-party platforms or the official app store.

Particularly, applications that provide crypto utilities and tracking are known for harboring malware, as their primary target includes crypto seed phrases. Additionally, clones of popular platforms like TikTok from unofficial sources are also notorious for containing such malware. Typically, SparkKitty spreads through applications related to gambling, casinos, and even adult-themed games.

Utilizing Antivirus Solutions with Behavioral Analysis

Many antivirus applications equipped with behavioral analysis can detect the presence of SparkKitty and similar threats. Since these malicious programs often send stolen images to a C2 server in the background, effective antivirus software will recognize this suspicious behavior and alert you.

We recommend using Bitdefender or Avast Mobile Security, both of which feature robust behavioral detection. Simply install the free versions of these apps and allow them to operate in the background, which will help catch any potentially harmful activities.

For critical information such as master passwords and recovery codes, consider physically writing them down instead of relying on digital storage options. Additionally, Android users should enable the relevant security features available on their devices for enhanced protection.

Source & Images