\n
![\"\"](\"https:\/\/www.securemac.com\/wp-content\/uploads\/2025\/02\/post-img-2.jpg\")
\t\t<\/span><\/p>\nScreen-Reading Malware Found in Apple\u2019s App Store, Targeting Crypto Wallets<\/h2>\n
\\In a concerning cybersecurity discovery, security firm Kaspersky has identified malware with screen-reading capabilities in Apple\u2019s App Store. Dubbed \u201c<\/strong>SparkCat<\/a>,\u201d<\/strong> the malware employs optical character recognition (OCR) to extract sensitive information from screenshots stored on users\u2019 devices. According to a MacRumors report<\/a>, the malware\u2019s primary target appears to be crypto wallet recovery phrases, which could allow attackers to steal Bitcoin and other cryptocurrencies.<\/p>\n Kaspersky reported several infected apps in the App Store, including ComeCome, WeTink, and AnyGPT. However, it remains unclear whether the malware was deliberately added by developers or if it was the result of a supply chain attack<\/a>. Apple has since removed the malicious apps from the App Store. When independently verified, only one of the reported apps showed any trace of previously existing on the platform, while the others were absent from search results.<\/p>\n The term supply chain attack<\/a> refers to a cyber-attack targeting less secure elements in a system\u2019s supply chain<\/a>, including software or hardware components. According to Wikipedia<\/a>, these attacks often involve injecting malicious code into widely used software dependencies. This means that even legitimate developers could have unknowingly integrated compromised code into their apps, spreading malware to unsuspecting users.<\/p>\n In this case, it\u2019s possible that:<\/p>\n Once installed, the malicious apps request permission to access a user\u2019s photo library. If granted, the malware scans stored images for text related to crypto wallet recovery phrases. When such text is detected, the image is transmitted to an attacker-controlled server.<\/p>\n While these apps primarily targeted iOS users in Europe and Asia, a supply chain attack<\/a> could mean that developers and users worldwide may also be at risk.<\/p>\n Kaspersky advises users to avoid storing sensitive information in screenshots<\/em>, especially crypto wallet recovery phrases and passwords. Given the malware\u2019s flexibility, other forms of sensitive data\u2014such as login credentials\u2014could also be at risk.<\/p>\n A safer alternative? Use a password manager<\/em><\/strong> instead of relying on screenshots to store critical information.<\/p>\n In yet another major cybersecurity incident, Grubhub, one of the U.S.\u2019s largest food delivery platforms, has confirmed that hackers accessed personal data belonging to customers, merchants, and drivers. The breach, first reported by TechCrunch<\/a>, is believed to have resulted from a third-party service provider\u2019s compromised account.<\/p>\n Grubhub has not disclosed the number of individuals impacted, but with over 200,000 delivery drivers and 375,000 merchants operating in more than 4,000 cities across the U.S<\/em>.<\/em><\/strong>, the scale of the breach could be significant. Notably, the breach affected users of Grubhub\u2019s Campus Dining service<\/a>, which allows university students to use meal credits for food deliveries.<\/p>\n While the full scope of the breach remains unclear, Grubhub has confirmed that hackers accessed:<\/p>\n Grubhub stated that it took immediate action after detecting \u201c<\/strong>unusual<\/em> activity<\/em>\u201d<\/strong> within its network. Their response included:<\/p>\n The company assured users that it is \u201cdedicated to protecting the trust\u201d<\/em> of its customers and partners, though it has not announced any direct support for affected users or provided a timeline for when they will disclose the total number of impacted individuals.<\/p>\n While Grubhub is reinforcing its security measures, customers and drivers remain in the dark about whether their personal data has been compromised. The company has yet to specify:<\/p>\n For now, users should monitor their accounts for suspicious activity and consider updating their Grubhub passwords.<\/p>\nAffected Apps and Apple\u2019s Response<\/h3>\n
Understanding Supply Chain Attacks<\/h3>\n
\n
How the Malware Works<\/h3>\n
Protecting Yourself<\/h3>\n
Grubhub Data Breach Exposes Customer and Driver Information<\/h2>\n
Who Was Affected?<\/h3>\n
What Information Was Stolen?<\/h3>\n
\n
How Did Grubhub Respond?<\/h3>\n
\n
What\u2019s Next?<\/h3>\n
\n