OCR technology

Researchers have identified over 280 malicious applications that exploit optical character recognition (OCR) technology to steal cryptocurrency wallet credentials from compromised Android devices. These apps, disguised as legitimate services, harvest sensitive information like text messages and images but are not found on Google Play, indicating distribution via phishing and dubious websites. The malware uses OCR to extract mnemonic phrases from images, making it easier for attackers to access cryptocurrency wallets. A McAfee researcher uncovered a server with stolen data due to poor security configurations, revealing the attackers' focus on capturing recovery phrases. The malware has evolved to use sophisticated communication methods and obfuscation techniques, complicating detection efforts. Initially targeting South Korea, the malware's recent emergence in the UK indicates a geographic expansion of its operations.