SpyAgent Malware: The OCR Menace Stealing Your Crypto Secrets from Screenshots

New Android malware, SpyAgent, uses OCR to steal cryptocurrency wallet recovery phrases from screenshots. With 280+ APKs distributed via SMS and social media, it targets South Korea and the UK, posing a serious threat. Keep your recovery phrases secure and avoid installing apps outside Google…

Hot Take:

Looks like cryptocurrency wallets need to watch their backs—or more accurately, their screenshots! SpyAgent is the new thief in town, using OCR to pickpocket your recovery phrases faster than you can say “blockchain.”

Key Points:

  • SpyAgent malware uses OCR to steal cryptocurrency recovery phrases from screenshots on Android devices.
  • Discovered in at least 280 APKs distributed outside Google Play via SMS and social media.
  • Pretends to be government services, dating sites, and pornography sites.
  • Primarily targeted South Korea but expanding tentatively to the UK.
  • Stolen data includes contact lists, SMS messages, images, and device info.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here