McAfee Labs' analysis of the "SpyAgent" Android malware revealed a sophisticated use of Optical Character Recognition (OCR) for extracting sensitive information, particularly mnemonic keys for cryptocurrency wallets.
The malware captures images stored on infected devices and uploads them to a remote Command and Control (C2) server.
Server-side OCR processes these images to extract text, specifically targeting mnemonic recovery phrases. This extracted data is critical for accessing and potentially stealing cryptocurrency assets.
Once the OCR extracts the text, the information is organized and managed through an administrative panel on the C2 server. This indicates a high level of sophistication in handling the stolen data, allowing attackers to efficiently process and utilize the extracted information.
Download
