SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases from screenshots stored on infected devices.
By stealthily capturing screenshots, the malware bypasses traditional security measures that rely on text-based detection, which allows it to efficiently identify and exfiltrate sensitive information, posing a significant threat to cryptocurrency users.
Cybercriminals are employing a phishing tactic to steal cryptocurrency. They send text messages luring users to download malicious apps that, once installed, capture screenshots of users’ cryptocurrency wallet recovery phrases.
These phrases are often stored as screenshots for quick reference and are essential for recovering lost wallets.
If compromised, attackers can access these wallets and drain them of their digital assets. As cryptocurrency transactions are irreversible, stolen funds are permanently lost to victims.
Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs
If users screenshot their recovery phrase and have it stolen by SpyAgent, attackers need only recover the wallet and transfer funds to the destination of their choice.
According to Coin Telegraph, the malware has been making the rounds in South Korea, with more than 280 APKs affected, which is distributed outside the official Google Play store, often using SMS messages or social media posts to capture user interest.
Some infected apps mimic South Korean or UK government services, while others appear to be dating or adult content applications.
There are also indications that attackers may be preparing to expand into the United Kingdom, which could lead to more widespread compromise.
While the malware is currently Android-only, there are signs that an iOS version may be in development.
OCR technology, commonly used for cryptocurrency recovery phrase theft, can pose significant risks to businesses and individuals.
Malicious actors can easily steal screenshots containing sensitive information like login credentials, personal data, or confidential contacts, leading to data breaches, identity theft, and unauthorized access to sensitive systems.
Even devices with strong security measures like MFA and SSO are vulnerable if users store sensitive information in screenshots, as these can be compromised through infected applications.
Stolen screenshots used to compromise mobile devices pose a significant security risk. Attackers can exploit these images to gain unauthorized access to critical services, lock out legitimate users, and exfiltrate sensitive data from various IT systems.
The delayed detection of such attacks, often exceeding 258 days, allows attackers ample time to execute their malicious activities, which underscores the need for robust security measures, including advanced threat detection and response capabilities, to mitigate the potential impact of such attacks.
According to IBM, cybersecurity threats are prevalent on mobile devices, as sensitive data such as crypto recovery passwords, corporate logins, and personal information should not be stored on devices.
Users should avoid unsolicited texts and download apps only from official app stores. To minimize risks, users should limit device data storage and prioritize using the official Google Play Store for app downloads.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!