Suspected North Korean Hackers Infiltrate Google Play With 'KoSpy' Spyware

Yahoo

12-03-2025

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.
Newly discovered spyware, possibly from a North Korean hacking group, was found circulating on the Google Play Store.
The spyware programs, dubbed "KoSpy," were masquerading as utility apps. But once installed, they secretly collected a wide range of data from Android devices, including SMS messages and screenshots, to cybersecurity vendor Lookout Mobile Security.
Lookout says it has "medium confidence" that KoSpy is linked to North Korean hacking groups such as APT37/, which has often focused on cyber espionage.
KoSpy targets apps that are in Korean and English. It infiltrated Google Play as an app called "File Manager - Android." Google has since removed the app, which only attracted about 10 downloads.
"The use of regional language suggests this was intended as targeted malware," a Google spokesperson tells us. "Before any user installations, the latest malware sample discovered in March 2024 was removed from Google Play. Google Play Protect automatically protects Android users from known versions of this malware on devices with Google Play Services, even when apps come from sources outside of Play."
In total, Lookout found KoSpy using five different names: 휴대폰 관리자 (Phone Manager), File Manager, 스마트 관리자 (Smart Manager), 카카오 보안 (Kakao Security), and Software Update Utility. The malicious apps usually feature a basic interface that can access an Android phone's internal settings. In others, the fake apps merely display a dummy system window asking for device permissions.
The spyware secretly communicates with a hacker-controlled server before downloading various plugins designed to snoop on and collect data from the Android device. In addition, the spyware can configure itself to display messages to the user in Korean or English.
Although the spyware dates back to at least March 2022, the most recently recovered sample was collected in March 2024. The command and control servers for the spyware were also found to be inactive, so KoSpy may be retired.
"Some of the samples of KoSpy were available for download from the Google Play Store alongside the third-party app store Apkpure. However, no app is currently publicly available on Google Play Store," Lookout says.
Google confirms that all of the apps identified were removed from Google Play. Their Firebase projects were also taken down.
Lookout also attributed KoSpy to APT37 since one of the domains that the spyware reaches out to resolves to an IP address in South Korea that's been associated with hacking activities from APT37 and another North Korean hacking group, APT43.
'North Korean threat actors are known to have overlapping infrastructure, targeting, and TTPs (tactics, techniques, and procedures), which makes attribution to a specific actor more difficult,' Lookout says.