Malicious iOS, Android apps can read screenshots for passwords: Here's how

Reportedly, some malicious apps on App Store and Play Store have been using Optical Character Recognition (OCR) technology to extract crypto wallet passwords from saved screenshots

Don't want to miss the best from Business Standard?

Several malicious apps on Android and iOS have been identified that can access saved screenshots to steal cryptocurrencies. According to a report by The Verge, citing cybersecurity firm Kaspersky, these apps utilise Optical Character Recognition (OCR) technology to extract text, including passwords, from images stored in the gallery. The report described this as the "first known case" of malicious apps using OCR that have been approved on Apple's App Store. 

 

What is OCR technology?

 

Optical Character Recognition (OCR) or Optical Character Reader is a technology that can recognise text within a digital image. It is commonly used to recognise text in scanned documents and images. It is also used in smartphones for allowing users to copy texts from an image.

 

How do these malicious apps attack?

 

Cybersecurity software firm Kaspersky discovered a particular malware called "SparkCat," late last year. Essentially, the malware triggers a request to access the device's photo gallery when a user attempts to initiate the chat support in an infected app. Once access is granted, the malware uses Google's OCR technology to extract text in photos, looking for sensitive data such as screenshots of crypto wallet passwords or recovery phrases. The extracted information is then sent to the attacker, who can exploit it to access the user's crypto wallets.

 

What apps are infected?

 

Kaspersky has identified two AI chat apps, WeTink and AnyGPT, that appear to have been specifically designed for the malware attack. Both apps remain available on the Apple App Store. Additionally, the firm has named a food delivery app, ComeCome, which has also been affected by the malware and is currently listed on both the App Store and Google Play Store.