How to protect your phone from SparkKitty photo-stealing malware

Many people store sensitive information as images, such as passphrases, password manager master passwords , authentication recovery codes, etc. Unfortunately, malware is getting smarter and is now targeting sensitive information stored as images, like the latest SparkKitty malware on phones. This guide lists all the ways to protect yourself from such threats.

What is SparkKitty Malware?

SparkKitty is a variant of the original image-stealing malware, SparkCat. While SparkCat focuses on using OCR to steal specific types of images (code phrases), SparkKitty simply uploads all images to a C2 (Command and Control) server. It is much more dangerous because it is not tied to a specific type of image.

Stolen photos can be used for more than just stealing recovery keys or passwords, such as blackmail, identity theft, and social engineering attacks . It is also difficult to detect because it often comes bundled with phone apps that have legitimate functionality and take advantage of default media permissions. Although common on third-party stores, many infected apps have also been found on official app stores, such as Soex and 币coin (which have since been taken down).

Secure sensitive photos

These photo-stealing malwares often target photos inside your library, so your first line of defense is to keep sensitive photos safe. The best way to do this is to hide sensitive photos in an encrypted vault so no one but you can access them. Here are two free solutions:

Using Google Photos Locked Folder

If you sync your photos with Google Photos , you can use the Locked Folder option to store your photos in an encrypted online vault. This will delete the photos from your phone and hide them in Google Photos.

Open the photo in Google Photos, tap the Add to button at the bottom, and select the Locked Folder option . You'll need to do a quick initial setup on your first try. To access the contents of your Locked Folder, go to Collections and open Locked Folder . You'll need to use a device unlock method to access it.

How to protect your phone from SparkKitty photo-stealing malware Picture 1

Using a third-party Photo Vault app

You can also use a third-party photo vault app if you don't want to use Google Photos or want to keep your photos offline. Keepsafe Photo Vault is a great app for this purpose, available for both Android and iOS . The app encrypts your photos (and other media) with a dedicated PIN or biometrics. You can also spoof the app icon to prevent further access attempts.

However, the app syncs photos to the cloud by default, make sure you disable this feature from Backup & Sync options if you want offline storage.

How to protect your phone from SparkKitty photo-stealing malware Picture 2

Manage application permissions

SparkKitty needs access to photos to be able to steal them, so the malware app must have this permission as well. You can check the permissions to make sure no unrelated or suspicious apps have access to photos.

On Android, go to Settings -> Privacy protection -> All permissions -> Photos and videos .
On iOS, go to Settings -> Privacy & Security -> Photos .

Here, make sure only trusted apps are allowed to access your photos. If an app looks suspicious or doesn't need media access to function, remove its permissions.

How to protect your phone from SparkKitty photo-stealing malware Picture 3

David Pac

Update 05 July 2025

You should read it

May be interested

What is FormBook Malware? How to remove?
if you manage sensitive data, you should be concerned about the formbook malware. once on a network or pc, this information-stealing malware can cause irreparable damage to your company.
What is Goldoson Malware? How can you protect yourself?
an example of malware is goldoson. the malware has infected more than 60 legitimate google play apps, which have been downloaded more than 100 million times in total.
5 types of malware on Android
malware or malware can affect mobile devices as well as computers. a little bit of knowledge and proper precautions can protect you from threats like ransomware and sextortion scam.
How to protect remote desktop from malware RDStealer
rdstealer is malware that tries to steal credentials and data by infecting an rdp server and monitoring its remote connections.
Instructions to block Facebook read theft messages on Android
ars technica has just announced the discovery that facebook has collected android users' messaging and call data for years. if you are using android devices, you must know how to block facebook from stealing messages on android to protect your personal information.
Prevent malware from breaking into the BIOS
malware (malware) can sneak into the bios in your computer and then activate itself before any anti-malware has a chance to detect it. therefore, you should set the password for the bios.
What is Joker Malware? The most effective way to protect against Joker Malware
joker malware is a sophisticated malware that targets mobile devices, especially on android and ios operating systems.
More than 394,000 Windows computers infected with data-stealing Lumma malware
in a new blog post, microsoft has released some worrying numbers about malware.
[Infographic] 7 effective ways to protect businesses from Ransomware
how to protect your business from ransomware? join tipsmake.com to follow the article to find the answer.
How to protect PowerShell from fileless attacks from the Remcos RAT malware
excel users need to be on guard as a newly discovered phishing campaign is targeting microsoft's spreadsheet application.