Igniting a DNS Spark to Investigate the Inner Workings of SparkCat

A recent investigation led to the discovery of Android and iOS apps laced with a malicious software development kit (SDK) dubbed “SparkCat.” As a result, the apps stole victims’ crypto wallet recovery phrases. Based on the malware time stamps and configuration file creation dates found in GitLab repositories, SparkCat has been seemingly active since March 2024.

SecureList published five indicators of compromise (IoCs) related to SparkCat.¹ WhoisXML API dove deep into the threat’s DNS footprints and uncovered other artifacts comprising:

• 611 email-connected domains, one of which turned out to be malicious
• 179 string-connected domains, one of which has already been weaponized for attacks

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/