I made at attempt to go through the article, but it seems enabling the site cookie is mandatory and not avoidable. While reading through the OP, I was trying to recall reading something about the SparkCat, but it seems January has been a longer time than I thought.

I have always expected a type of malware specifically to target seed phrase screenshots to be introduced sooner. Though, good and secure mobile wallet applications don't permit and allow users to take screenshots of their seed phrase, but some users can go as far as using other phones to capture it all at once. We as users have to understand that the evolution of internet does not guarantee our own security. It makes lives better, but we are still very much at risks.

@OP, are there ways of identifying this type of malware, aside avoiding unnecessary downloads or using fake play stores?.