SparkCat Trojan steals personal data from Android and iOS

[khaled0111]

You cannot be vigilant when downloading applications, it is either you are downloading them or not, there is also no way to know the applications that have this trojan malware. If you keep your assets in a hot wallet, you are vulnerable to malwares like this

You are totally right. You can never be vigilant enough. As you can see from the list of some of the infected apps posted above, even legitimate apps were infected with this trojan. Which makes me wonder if those malicious codes were added by the devs intentionally?
Anyway, the best thing to do to keep your wallets safe is to never use your daily driver phone (or pc) for crypto-related activities. Better use an offline device to save your seeds and any other important data.

[lovesmayfamilis]

You cannot be vigilant when downloading applications, it is either you are downloading them or not, there is also no way to know the applications that have this trojan malware. If you keep your assets in a hot wallet, you are vulnerable to malwares like this, that is why it is advised to keep your assets offline in a hardware wallet and you keep only a small amount of money in your hot wallet.

There are guides on how to avoid stealing your data through applications; it is necessary to prohibit access to the gallery. Sometimes we wonder why a pizza delivery application, for example, needs to see our photos. But how many people think about this?
Likewise, no one has ruled out installing antivirus software and regularly updating their phones; this is always recommended. Application ratings, with reviews, will also be very useful in order not to make mistakes in the legality of the downloaded application. As experts advise, ratings should exceed a million downloads.

[Lucius]

@lovesmayfamilis, good AV needs to be paid for, and a lot of people don't want to do that even for their computer, let alone for their smartphone. Of course, having AV on the device (even the best rated one) cannot save those who, despite the warning that the app is harmful, still give permission for the app to be installed.

What is also a problem is that smartphone manufacturers have relatively short support for them in the form of security updates, much shorter than the time people normally use their devices. In this way, they encourage people to buy a new device, even though the old one is not damaged, broken or otherwise non-functional.

Additionally regarding the rating - the app can have 10 million downloads, but that does not mean that a future new version/upgrade cannot contain malicious code.

[promise444c5]

Like Uber dynamically adjusting taxi price based on your battery level - because you're not waiting for a cheaper option with 4% left while standing in the street. I can't know if that or another one is true.
But the fact that this data is available and accessible by advertisers suggests that they should at least think of using it.
I would.

Hahaha interesting  
Although i know app can get access to reading some infos like device type,versions, model, battery,ipaddress and lot more, some without the need of permission .. Games for example reads battery level and display them as part of  UI even while playing  but an Uber doing that is quite hillarious,  this means the manipulation price might not even come from the  server or probably there's a manipulation category section in the DB  regarding low battery health lol

Sometimes we wonder why a pizza delivery application, for example, needs to see our photos. But how many people think about this?

I have actually downloaded an app for dexterity and it was asking for permission to read contents on my phone after getting the interaction permission already... looks fishy and i had to delete it immediately .
Pizza accessing phtos maybe for particular type of order probably specified by a customer  since it's end to end but i don't think it's necessary for having to select only from a provided choice  although never used one i always go get it myself

[GreatArkansas]

Storing documents, passwords, banking data, or photos of seed phrases in your smartphone’s gallery is highly unsafe — besides stealers such as SparkCat, there’s also always the risk that someone peeks at the photos, or you accidentally upload them to a messenger or file-sharing service. Such information should be stored in a dedicated application.

https://www.kaspersky.co.uk/blog/ios-android-ocr-stealer-sparkcat/28661/

As said in the article from OP, this is really indeed proper and basic security we must practice. Before, we were worried about storing cloud or any online platform our sensitive data like passwords, seedphrases, etc.
Now, we must also practice not to store locally like in our phone photos, galleries, etc. This really makes sense, our phone most of the time in internet.