Vladimir Kuskov on the threats that hide in plain sight

## SparkCat: App Store Stealer

Kaspersky Anti-Malware Research head Vladimir Kuskov discusses SparkCat, the first large-scale iOS stealer distributed through official app stores. Discovery began when Android Play Market monitoring flagged dynamically loaded code; cross-platform investigation found Rust-based apps using machine vision to scan photo galleries for cryptocurrency wallet recovery phrases.

## Evasion and Moderation Gaps

Apps posed as legitimate delivery and editing tools with real functionality plus hidden payloads. Heavy obfuscation and iOS research barriers made analysis difficult. Apple and Google removed apps after disclosure—rare for iOS, where malicious titles seldom reach consumers.

## Firmware and EDR Bypass Trends

Kuskov outlines UEFI threat scanning developed as bootkit samples proliferated, plus defenses against vulnerable-driver abuse that collapses kernel-user isolation. Attackers increasingly block EDR telemetry via firewall rules—legitimate OS capabilities repurposed—requiring vendors to harden self-protection across Windows versions.

## Threat Intelligence as Product

Kaspersky's ATT&CK-aligned intelligence portal lets customers filter by region, industry, and platform to prioritize detection rules. Unlike generic framework examples, Kaspersky supplies command-line samples, file hashes, and ready-made YARA-style guidance—aiming to replace manual parsing of thousands of annual threat reports for SOC tier-three analysts.