Kaspersky Labs says a software development kit for Google and Apple phone apps contains malware that can scan pictures for crypto wallet recovery phrases.