{"id":58126,"date":"2025-02-07T03:03:57","date_gmt":"2025-02-07T03:03:57","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/apple-missed-screenshot-snooping-malware-in-code-that-made-it-into-the-app-store-kaspersky-claims\/"},"modified":"2025-02-07T03:03:57","modified_gmt":"2025-02-07T03:03:57","slug":"apple-missed-screenshot-snooping-malware-in-code-that-made-it-into-the-app-store-kaspersky-claims","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/apple-missed-screenshot-snooping-malware-in-code-that-made-it-into-the-app-store-kaspersky-claims\/","title":{"rendered":"Apple missed screenshot-snooping malware in code that made it into the App Store, Kaspersky claims"},"content":{"rendered":"

Kaspersky eggheads say they\u2019ve spotted the first app containing hidden optical character recognition spyware in Apple\u2019s App Store. Cunningly, the software nasty is designed to steal cryptocurrency.<\/p>\n

The researchers found the malware in an iOS app called ComeCome, which is also available from Google\u2019s Play store, and claims to offer food delivery services. According to Kaspersky’s Dmitry Kalinin and Sergey Puzan, the application also delivers the keys to victims\u2019 crypto holdings to crooks.<\/p>\n

The app can do that as, according to Kaspersky\u2019s analysts<\/a> this week, it is \u201cembedded with a malicious SDK\/framework\u201d that at an unspecified moment decrypts an optical character recognition (OCR) plugin. Once that OCR code is running, the app hunts for screenshots on mobile devices in the hope that some include cryptocurrency wallet recovery phrases, aka seed phrases, that the OCR will extract and the spyware will exfiltrate.<\/p>\n