The malware scans users' images for ones that contain wallet recovery phrases. Matching images are then encrypted and transmitted to a remote server.