SpyAgent Android Malware Targets Crypto Recovery Phrases Through Images 📱

News & Articles
1

Summary:

  1. Malware Overview
    SpyAgent is a new Android malware that uses optical character recognition (OCR) to extract cryptocurrency wallet recovery phrases from screenshots on infected devices. This allows attackers to gain access to and steal funds from cryptocurrency wallets.

  2. Distribution and Function
    Distributed via SMS and malicious social media posts, SpyAgent has been found in at least 280 APKs outside Google Play. Once installed, it steals sensitive information, including contact lists, incoming SMS messages (with OTPs), and images for OCR scanning.

  3. Threat and Security Practices
    The malware’s operators did not follow secure server practices, which led to McAfee accessing stolen files and confirming multiple victims. SpyAgent can also manipulate device settings and send phishing texts to further spread the malware.

Read more at: BleepingComputer