Kimsuky Spreads Docswap Android Malware Via Qr Phishing Posing As...

The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics (formerly CJ Korea Express).

"The threat actor leveraged QR codes and notification pop-ups to lure victims into installing and executing the malware on their mobile devices," ENKI said. "The malicious app decrypts an embedded encrypted APK and launches a malicious service that provides RAT capabilities."

"Since Android blocks apps from unknown sources and displays security warnings by default, the threat actor claims the app is a safe, official release to trick victims into ignoring the warning and installing the malware."

According to the South Korean cybersecurity company, some of these artifacts masquerade as package delivery service apps. It's being assessed that the threat actors are using smishing texts or phishing emails impersonating delivery companies to deceive recipients into clicking on booby-trapped URLs hosting the apps.

A noteworthy aspect of the attack is its QR code-based mobile redirection, which prompts users visiting the URLs from a desktop computer to scan a QR code displayed on the page on their Android device to install the supposed shipment tracking app and look up the status.

Present within the page is a tracking PHP script that checks the User-Agent string of the browser and then displays a message urging them to install a security module under the guise of verifying their identity due to supposed "international customs security policies."

Should the victim proceed to install the app, an APK package ("SecDelivery.apk") is downloaded from the server ("27.102.137[.]181"). The APK file then decrypts and loads an encrypted APK embedded into its resources to launch the new version of DocSwap, but not before ascertaining that it has obtained the necessary permission to read and manage external storage, access the internet, and install additional packages.

"Once it confirms all permissions, it immediately registers the MainService of the newly loaded APK as 'com.delivery.security.MainService,'" ENKI said. "Simultaneously with service registration, the base application launches AuthActivity. This activity masquerades as an OTP authentication screen and verifies the user's identity using a delivery number."

The shipment number is hard-coded within the APK as "742938128549," and is likely delivered alon

Source: The Hacker News