E-Business
Firm Discovers New Crypto-stealing Trojan in AppStore, Google Play
Kaspersky Threat Research expertise center has discovered a new data-stealing Trojan, SparkCat, active in AppStore and Google Play since at least March 2024. This is the first known instance of optical recognition-based malware appearing in AppStore.
SparkCat uses machine learning to scan image galleries and steal screenshots containing cryptocurrency wallet recovery phrases. It can also find and extract other sensitive data in images, such as passwords. Kaspersky has reported known malicious applications to Google and Apple.
How the new malware spreads
The malware is spreading through both infected legitimate apps and lures – messengers, AI assistants, food delivery, crypto-related apps, and more. Some of these apps are available on official platforms in Google Play and AppStore.
Kaspersky telemetry data also shows that infected versions are being distributed through other unofficial sources. In Google Play, these apps have been downloaded over 242,000 times.
Who is being targeted
The malware primarily targets users in the UAE and countries in Europe and Asia. This is what experts concluded based on both the information about the operational areas of the infected apps and the technical analysis of the malware.
SparkCat scans image galleries for keywords in multiple languages, including Chinese, Japanese, Korean, English, Czech, French, Italian, Polish, and Portuguese. However, experts believe victims could be from other countries as well.
How SparkCat works
Once installed, in certain scenarios the new malware requests access to view photos in a user’s smartphone gallery. It then analyses the text in stored images using an optical character recognition (OCR) module. If the stealer detects relevant keywords, it sends the image to the attackers.
The hackers’ primary goal is to find recovery phrases for cryptocurrency wallets. With this information, they can gain full control over a victim’s wallet and steal funds. Beyond stealing recovery phrases, the malware is capable of extracting other personal information from screenshots, such as messages and passwords.
“This is the first known case of OCR-based Trojan to sneak into AppStore,” said Sergey Puzan, malware analyst at Kaspersky. “In terms of both AppStore and Google Play, at the moment it’s unclear whether applications in these stores were compromised through a supply chain attack or through various other methods. Some apps, like food delivery services, appear legitimate, while others are clearly designed as lures.”
“The SparkCat campaign has some unique features that make it dangerous. First of all, it spreads through official app stores and operates without obvious signs of infection. The stealthiness of this Trojan makes it hard to discover it for both store moderators and mobile users.
Also, the permissions it requests seem reasonable, making them easy to overlook. Access to the gallery that the malware attempts to reach may seem essential for the app to function properly, as it appears from the user perspective. This permission is typically requested in relevant contexts, such as when users contact customer support,” added Dmitry Kalinin, malware analyst at Kaspersky.
Analysing Android versions of the malware, Kaspersky experts found comments in the code written in Chinese. Additionally, the iOS version contained developer home directory names, “qiongwu” and “quiwengjing”, suggesting that the threat actors behind the campaign are fluent in Chinese. However, there is not enough evidence to attribute the campaign to a known cybercriminal group.
ML-powered attacks
Cybercriminals are increasingly paying attention to neural networks in their nefarious tools. In the case of SparkCat, the Android module decrypts and executes an OCR-plugin using the Google ML Kit library to recognise text in stored images. A similar method was used in its iOS malicious module.
President Bola Tinubu said that his administration has initiated a project to install fibre optic cables across the country, aimed at enhancing the socio-economic development of Nigeria.
His plans were contained in a speech he delivered at a joint session of the National Assembly in commemoration of Democracy Day on Thursday, June 12.
He said the fibre optic layout is part of other projects being embarked on.
“In addition, we have embarked on an ambitious project to lay fibre optic cables across the nation, a transformative step toward bridging the digital divide and fostering greater connectivity.
“This initiative promises not only to enhance the speed and reliability of internet access but also to revolutionise how businesses operate, how students learn, and how communities stay connected,” Tinubu stated.
He maintained that by extending this critical infrastructure, his government is empowering entrepreneurs, enabling digital education, and providing the tools for our youth to compete in a globalised world.
In a most recent report on Internet connectivity, The ICIR pointed out how Nigeria has faced setbacks in its deployment of fibre optic cables and needs a transformation.
The challenges revolve around vandalism, inadequate coordination between road construction and telecom infrastructure, and varying right-of-way (RoW) charges across states.
Among industry experts, these issues impact network outages, increase repair costs, and hinder broadband expansion efforts.
It has also further threatened the digital economy, leading to slower Internet speeds, dropped calls, and unreliable connectivity among others.
African startups raised more than $345 million across 65 deals in May, more than double the amount raised in the same period of last year, according to a report by Briter, a research and business intelligence firm.
The report disclosed that both the number of deals and participating companies declined, confirming a growing trend of fewer companies raising funds in larger sizes.
It said fintech attracted the highest share of funding in May, accounting for 34 percent of the total, while cleantech followed closely, driven by a debt deal from Sun King. The company raised $80 million (in local currency) to expand clean energy access in Nigeria.
“Equity remains the primary instrument in terms of total value. There’s no doubt about it; in fact, equity deals with disclosed amounts captured more than half of the total funding volume in May.
“However, debt financing is increasingly proving its weight. Although it accounted for only 8 percent of all deals, it represented 32 percent of the total funding, highlighting the typically larger size of debt transactions. With the rise of specialised vehicles targeting early-stage businesses, debt is becoming an increasingly important part of Africa’s innovation funding landscape,” it said.
Briter’s report added that grants continued to play a vital role in early-stage support, especially in the education technology (EdTech) sector. The Mastercard Foundation led the pack in grant activity, funding a new cohort of EdTech innovators in Nigeria and Kenya. Each selected startup is set to receive $100,000 in grant funding, in addition to mentorship and business development support.
Multilaterals also made a strong showing in May, it said. The Multilateral Investment Guarantee Agency (MIGA), a World Bank Group member, issued a $179.6 million guarantee to CleanTech firm KOKO Networks. The support will help scale its clean energy solutions across Kenya.
“This deal not only demonstrates growing international confidence in African climate ventures but also signals a promising pathway for other asset-intensive startups in clean cooking, agriculture, and renewable energy,” the report said.
From a geographic perspective, Egypt emerged as the continent’s fundraising powerhouse for the month, contributing 51 percent of all funding raised. The country recorded 12 deals across equity, debt, and bond instruments. Notably, FinTech platform MNT-Halan raised $50 million through a bond issuance, further illustrating the diversification of capital-raising mechanisms in the region.
Outside Egypt, funding was distributed across Africa’s three other key markets, which are Egypt, Nigeria, and Kenya, with limited activity recorded in countries such as Ghana, Tunisia, Morocco, and Uganda, each registering between one and three deals.
In terms of exits, the African tech landscape continues to mature. Three companies—Baobab+, Qardy, and Shopa—were acquired in May, bringing the total number of exits this year to 22. This already surpasses last year’s count for the same period. Qardy was acquired by Catalyst Partners Middle East (CPME) in a disclosed deal valued at $23 million, the report added.
By Nancy Werteen
When you get anti-hacking advice, you’ve probably heard “Don’t use a simple password,” or “Don’t plug in that USB you found on the ground.”
But there’s one form of hacking that doesn’t always require a computer, and it costs businesses about 4.88 million dollars a year.
Modern hackers aren’t trying to get into your computer; they’re trying to get into you.
“They’ll try to learn about you a little bit, and they’ll try to use that information against you to try to get you to complete some action, maybe to send somebody some money,” said Kevin Moran, PhD, Assistant Professor of Computer Science, Cyber Security and Privacy Cluster, University of Central Florida.
IBM calls this human hacking, because it exploits human error instead of system error.
“With people just being busy and maybe not very carefully checking some of the emails or the phone calls that they get, can be something unfortunately that people can fall victim to,” said Moran.
Also known as social engineering, this often takes the form of phishing, where the hacker tries to “fish” the information out of you by impersonating family, friends, or even your bank.
There’s also baiting, where the hacker baits you with something of value. Remember the Nigerian prince scam?
That’s a famous example of baiting. There’s also pretexting, where the hacker will claim the victim has already been hacked, and that the hacker can fix it if you just send over your passwords. So, what can you do?
“Just as a rule of thumb, instead of clicking on links and emails, just go to the website yourself. And that will prevent, a lot of these types of attacks from happening,” explained Moran.
Phishing can take many forms.
Spear phishing targets people with access to confidential information, often to get access into an entire business, and whale phishing targets CEOs or political figures.
Search engine phishing is when hackers create fake websites promising services or goods you’ll never receive.
Angler phishing is when hackers create fake social media accounts impersonating famous people or companies.
Finally, vishing and smishing is phishing done through phone calls and texts respectively.
China Expands Zero-Tariff Trade for Nigeria, 52 Other African Nations
Sterling Bank Pledges ₦2bn to Fully Fund University Scholarships
MTN Nigeria Unveils CPaaS Platform to Transform Business Communication
Aliko Dangote Signs out @ Dangote Sugar Refinery as Chairman
Court Declines Access Bank’s Request to Freeze MTNN Account over N180Bn Claims
General News3 days agoAfDB to Provide $184.1mfor Africa’s Largest Solar Energy, Battery Storage Project
General News3 days agoCourt Declines Access Bank’s Request to Freeze MTNN Account over N180Bn Claims
News3 days agoReport Reveals New Malware Posing as an AI Assistant Steals User Data
Telecom3 days agoMTN Mulls Establishment of Fintech Firm in Nigeria, Others
News3 days agoAliko Dangote Signs out @ Dangote Sugar Refinery as Chairman
E-Business3 days agoFG Mulls Fibre Optic Layout to Bridge Internet Gaps
E-Financial3 days agoFG to Train 100,000 Youths Annually in Forex Trading and Financial Skills
E-Financial2 days agoSterling Bank Pledges ₦2bn to Fully Fund University Scholarships