Recent findings have uncovered that both Android and iOS applications available on Google Play and the App Store are using a malicious SDK or framework that steals recovery phrases for cryptocurrency wallets. This raises serious concerns about the effectiveness of the walled garden security model, traditionally relied upon in app stores to protect users from malicious software. The malware, identified as 'SparkCat', is notable for being written in Rust, a programming language not commonly associated with mobile application development, and utilizes an unidentified protocol for its command and control (C2) communications. Such innovations in malware coding make it imperative for developers and security professionals to remain vigilant and address potential vulnerabilities within the app ecosystem.