third-party app store

A new Android spyware called KoSpy has been linked to North Korean threat actors, specifically the group APT37 (ScarCruft), and has infiltrated Google Play and APKPure through malicious applications. The campaign has been active since March 2022, targeting Korean and English-speaking users with apps disguised as file managers, security tools, and software updaters. Five identified applications involved are: 휴대폰 관리자 (Phone Manager), File Manager (com.file.exploer), 스마트 관리자 (Smart Manager), 카카오 보안 (Kakao Security), and Software Update Utility. KoSpy retrieves an encrypted configuration file from a Firebase Firestore database and connects to a command and control (C2) server, allowing it to evade detection. Its data collection capabilities include intercepting SMS and call logs, real-time GPS tracking, reading files, using the microphone and camera, taking screenshots, and recording keystrokes. Each application operates with a distinct Firebase project and C2 server for data exfiltration, with data encrypted using a hardcoded AES key. Although the spyware apps have been removed, users are advised to manually uninstall them and use security tools to eliminate any remnants. Google Play Protect can block known malicious apps, and all identified KoSpy applications have been removed from Google Play.