Kimsuky, a North Korean threat actor, has been connected to a recent campaign that uses QR codes posted on phishing websites that imitate the Seoul-based transportation company CJ transportation (previously CJ Korea Express) to spread a new version of Android malware called DocSwap.
According to ENKI, the threat actor tricked victims into installing and running the malware on their mobile devices by using QR codes and notification pop-ups. The malicious program initiates a malicious service with RAT capabilities after decrypting an embedded encrypted APK.
The threat actor pretends the app is a secure, official release in order to fool victims into disregarding the warning and installing the virus because Android by default rejects apps from unknown sources and shows security warnings.
The South Korean cybersecurity firm claims that some of these artifacts pose as applications for parcel delivery services. It is being determined that the threat actors are tricking consumers into clicking on booby-trapped URLs hosting the programs read more about Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.