A new Android spyware named 'KoSpy' is linked to North Korean threat actors who have infiltrated Google Play and third-party app store APKPure through at least five malicious apps. The five apps Lookout identified are 휴대폰 관리자 (Phone Manager), File Manager (com.file.exploer), 스마트 관리자 (Smart Manager), 카카오 보안 (Kakao Security), and Software Update Utility. Although the spyware apps have now been removed from both Google Play and APKPure, users will need to manually uninstall them and scan them with security tools to uproot any remnants of the infection from their devices. A Google spokesperson confirmed to BleepingComputer that all the KoSpy apps identified by Lookout have been removed from Google Play and that the corresponding Firebase projects have also been taken down. The campaign was attributed to APT37 based on IP addresses previously linked to North Korean operations, domains that facilitated the distribution of Konni malware, and infrastructure that overlaps with APT43, another DPRK-sponsored threat group. Google Play Protect is also able to block known malicious apps, so enabling it on up-to-date Android devices can help protect against KoSpy. Before any user installations, the latest malware sample discovered in March 2024 was removed from Google Play," Google told BleepingComputer.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 12 Mar 2025 17:35:20 +0000