Microsoft Uncovers EngageLab SDK Flaw Affecting 50 Million Android Devices Microsoft security researchers identified a critical intent redirection vulnerability in the EngageLab SDK, a widely used software development kit for Android apps. The flaw, discovered in April 2025, allowed malicious apps on the same device to bypass Android’s security sandbox and access private user data. The vulnerability affected version 4.5.4 of the SDK, with a patch released in November 2025 (version 5.2.1). At least 50 million Android devices had apps containing the bugged SDK, with 30 million installs tied to cryptocurrency applications, amplifying the potential risk. All vulnerable apps were subsequently removed from the Google Play Store. While Microsoft found no evidence of active exploitation before the flaw’s discovery, the incident highlights the supply-chain risks posed by third-party SDKs, particularly in high-value sectors like digital asset management. The case underscores how unvalidated trust assumptions in app integrations can lead to large-scale security exposures.

SparkCat Infostealer Resurfaces in App Store and Play Store with Advanced Obfuscation Cybersecurity researchers at Kaspersky have identified a resurgence of SparkCat, a mobile-focused infostealer targeting cryptocurrency seed phrases, hidden within apps on both the Apple App Store and Google Play Store. Despite rigorous vetting processes by Apple and Google, threat actors successfully distributed the malware through seemingly legitimate apps, including enterprise messengers and food delivery services. First detected in 2025, SparkCat initially targeted Asian users by scanning for Japanese, Korean, and Chinese keywords in seed phrases 12- or 24-word recovery phrases used to restore cryptocurrency wallets. The malware employed Optical Character Recognition (OCR) to extract seed phrases from photos and screenshots, a tactic that previously drew attention for its sophistication. The latest version introduces new obfuscation techniques, including code virtualization and cross-platform languages, making detection significantly harder. While the Android variant continues to focus on Asian languages, the iOS version now targets English mnemonics, expanding its reach to Western users. Kaspersky reported the findings to Apple and Google, leading to the removal of some malicious apps. However, the incident highlights ongoing challenges in securing official app marketplaces against evolving malware threats.