North Korean Spyware Disguised as Android Apps Found on Google Play

Researchers have discovered at least five Android apps on Google Play that secretly function as spyware for the North Korean government. Despite passing Google Play’s security checks, these apps collect personal data from users without their knowledge. The malware, dubbed KoSpy by security firm Lookout, is embedded in utility apps that claim to assist with file management, software updates, and even device security. 

However, instead of providing real benefits, these apps function as surveillance tools, gathering a range of sensitive information.

KoSpy-infected apps can collect SMS messages, call logs, location data, files, nearby audio, keystrokes, Wi-Fi details, and installed apps. Additionally, they can take screenshots and record users’ screens, potentially exposing private conversations, banking credentials, and other confidential data. All collected information is sent to servers controlled by North Korean intelligence operatives, raising serious cybersecurity concerns. 

Lookout researchers believe with “medium confidence” that two well-known North Korean advanced persistent threat (APT) groups, APT37 (ScarCruft) and APT43 (Kimsuki), are behind these spyware apps. These groups are known for conducting cyber espionage and targeting individuals in South Korea, the United States, and other countries. The malicious apps have been found in at least two app stores, including Google Play and Apkpure. The affected apps include 휴대폰 관리자 (Phone Manager), File Manager, 스마트 관리자 (Smart Manager), 카카오 보안 (Kakao Security),

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.