--- title: New Android SpyAgent Malware Uses OCR to Steal Crypto... description: A new malware campaign, SpyAgent, targets Android users in South Korea and the U.K. through fake apps. The malware uses OCR to steal mnemonic keys from images... canonical: https://daily.dev/posts/new-android-spyagent-malware-uses-ocr-to-steal-crypto-wallet-recovery-keys-fzbhjx6ax twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys | daily.dev og:description: A new malware campaign, SpyAgent, targets Android users in South Korea and the U.K. through fake apps. The malware uses OCR to steal mnemonic keys from images... og:url: https://daily.dev/posts/new-android-spyagent-malware-uses-ocr-to-steal-crypto-wallet-recovery-keys-fzbhjx6ax og:image: https://api.daily.dev/og/posts/FzBHJx6Ax.png og:image:alt: New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys **[The Hacker News](https://daily.dev/sources/thn)** · 3 min read · 1 upvotes · 0 comments ## Summary A new malware campaign, SpyAgent, targets Android users in South Korea and the U.K. through fake apps. The malware uses OCR to steal mnemonic keys from images on devices, allowing attackers to control cryptocurrency wallets. It exfiltrates data to an external server with significant security lapses. A shift to WebSocket communications makes it harder to detect. This is similar to previous CraxsRAT malware targeting banking users in Malaysia and Singapore. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mobile](https://daily.dev/tags/mobile), [#android](https://daily.dev/tags/android), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-android-spyagent-malware-uses-ocr-to-steal-crypto-wallet-recovery-keys-fzbhjx6ax) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys","url":"https://daily.dev/posts/new-android-spyagent-malware-uses-ocr-to-steal-crypto-wallet-recovery-keys-fzbhjx6ax","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-android-spyagent-malware-uses-ocr-to-steal-crypto-wallet-recovery-keys-fzbhjx6ax"},"datePublished":"2024-09-09T09:06:27.271Z","dateModified":"2024-12-09T12:36:59.708Z","description":"A new malware campaign, SpyAgent, targets Android users in South Korea and the U.K. through fake apps. The malware uses OCR to steal mnemonic keys from images...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ed1ca52c0da2596ce4a76dc2558e9aa5?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ed1ca52c0da2596ce4a76dc2558e9aa5?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-android-spyagent-malware-uses-ocr-to-steal-crypto-wallet-recovery-keys-fzbhjx6ax","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mobile,android,crypto,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys"}]} ```