Android SpyAgent Malware: OCR Theft of Crypto Wallet Recovery Keys

A wallet recovery phrase stored as a screenshot can become a route to theft. In September 2024, McAfee reported an Android malware campaign, known as SpyAgent, that collected images and used image recognition to identify cryptocurrency recovery credentials. This article discusses that reported campaign and the legal and practical response for Indian users; it is not a claim that a new India-wide outbreak has been confirmed. 1

What the researchers reported

McAfee described more than 280 fake applications impersonating services such as banking, government, streaming and utilities. The reported activity primarily targeted South Korea. Distribution relied on phishing links and deceptive sites encouraging users to install apps, rather than evidence that these particular apps were ordinary verified downloads from Google Play. 1

Once installed and granted permissions, malicious apps could collect messages, contacts and images. A familiar logo, polished website or convincing loading screen was not proof of legitimacy. The important lesson for Indian readers is the attack method, not an assumption that every suspicious Android app is SpyAgent.

How OCR exposes a recovery phrase

Optical character recognition converts text visible in an image into machine-readable words. If malware obtains a screenshot containing a wallet’s seed phrase, an attacker may be able to restore the wallet on another device. Recovery phrases commonly contain 12 or 24 words, depending on the wallet and standard.

A wallet PIN, phone screen lock or ordinary exchange password may not protect funds once the wallet’s recovery phrase is exposed. Changing the phone PIN does not invalidate that phrase. Deleting the screenshot after theft also does not revoke a copy already taken by an attacker.

What to do if you installed a suspicious APK

Stop entering passwords, recovery phrases or banking information on the affected device. Disconnect it from networks where practicable and use a separate, trusted device to contact your bank, exchange or wallet provider. Do not follow “support” links supplied by the suspected attacker.

Preserve the phishing message, source URL, app name, installation time and transaction details. Keep the phone available for professional examination where appropriate. Avoid repeatedly opening the app or wiping the device before considering evidence preservation, but do not delay urgent action to protect remaining funds.

For a potentially compromised self-custody wallet, seek verified guidance on moving remaining assets to a new wallet created on a clean device with a new recovery phrase. A compromised phrase should not be reused. Network fees, permissions and token approvals can complicate the process; never share the phrase with someone claiming they need it to “recover” funds.

Reporting crypto theft in India

For cyber-enabled financial fraud, contact the national helpline 1930 promptly and file a report at cybercrime.gov.in. Keep the acknowledgment and approach the appropriate cyber police or police station with supporting evidence. Contact the relevant exchange quickly if stolen funds pass through a platform that can assist law enforcement.

A helpline complaint is not a guarantee of a freeze, an FIR or repayment. Blockchain transfers may be irreversible, and practical recovery depends on tracing, available records, intermediary cooperation and lawful investigative measures. Do not pay a “recovery agent” who guarantees results or asks for the seed phrase.

What evidence is useful?

• Wallet addresses, transaction hashes, network name and timestamps.
• Exchange account details and correspondence, without passwords or secret keys.
• The malicious message, website address and app installation source.
• Screenshots of unauthorised transfers and complaint acknowledgments.
• A chronology linking device activity to loss, plus any expert examination report.

Preserve original files and devices where possible. A transaction hash can show an on-chain transfer, but does not by itself identify the human controlling the receiving address.

Relevant Indian legal issues

Depending on evidence, unauthorised access and dishonest or fraudulent computer-related activity may engage sections 43 and 66 of the Information Technology Act, 2000. Identity theft under section 66C and cheating by personation through a computer resource under section 66D may be relevant where their elements are satisfied. Other offences under the Bharatiya Nyaya Sanhita can also require consideration.

The Bharatiya Sakshya Adhiniyam, 2023 governs current evidentiary questions, including section 63 requirements for electronic records where applicable. A screenshot’s existence is not the same as proof of authenticity, ownership, attribution or admissibility. The date of the conduct and the applicable transitional rules should be checked before selecting statutory provisions.

Prevention without false reassurance

Keep recovery phrases offline using a method appropriate to the wallet. Avoid screenshots, cloud-synced photos and emailed copies. Install apps from trusted sources, examine permissions, update the operating system and verify urgent messages independently. Security software can help, but no single product guarantees protection.

Does deleting the malicious app restore a compromised wallet?

No. Removing malware may help secure the device, but it does not change a seed phrase already stolen.

Should I send my seed phrase to a lawyer or police by email?

Do not circulate it. Discuss a safe evidence-preservation method instead; public wallet addresses and transaction hashes are normally the starting point.

For cybercrime complaint assistance in Mumbai, Thane or Mira Road, see APS Law’s cyber-law practice or request a consultation. Recovery is not guaranteed.