Kaspersky researchers found apps in Google's Play Store and Apple's App Store that use OCR to steal crypto wallet recovery phrases from images on users' devices
Android and iOS apps on the Google Play Store and Apple App Store contain a malicious software development kit (SDK) …
Context & Ripple Effects
This extends a recurring mobile-store security problem: Google Play previously hosted apps linked to bank-credential theft, while both major stores later removed apps tied to large-scale ad fraud. The new finding matters because the malicious behavior is embedded in an SDK, making the app supply chain—not only an app’s visible purpose—the relevant security boundary.
The target has also moved beyond login credentials and authentication codes, which prior Android research showed could be extracted from screenshots or apps. Here, image access and OCR create a route to high-value recovery material across both mobile ecosystems.
First-order effects
- Users of the identified Android and iOS apps may have recovery phrases stored in device images extracted by the embedded SDK, putting affected crypto wallets at risk.
- Google and Apple face an immediate review and removal task that includes tracing the malicious SDK across other apps, not merely evaluating the initially identified listings.
Second-order effects
- App developers using third-party SDKs will need to audit their dependencies and image-access behavior; otherwise, legitimate-looking apps can inherit a serious security exposure.
- Store-review systems will face pressure to detect how SDKs process local images and transmit sensitive text, rather than relying chiefly on an app’s stated functionality or listing signals.
Third-order effects
- If SDK-mediated abuse persists, mobile-platform security will increasingly become a software-supply-chain governance issue, with tighter scrutiny of reusable components and the permissions they exercise.
- The episode reinforces a broader shift toward protecting sensitive data at the device level: scanning or storing recovery phrases as images becomes a weaker security practice when apps can access those images.
The trend: Mobile app-store security is shifting from policing individual malicious apps toward continuous oversight of third-party SDKs and their access to sensitive on-device data.