Kimsuky Hackers Attacking Users via Weaponized QR Code to Deliver Malicious Mobile App
The North Korean threat group Kimsuky has expanded its attack methods by distributing mobile malware via weaponized QR codes. This tactic targets users through phishing sites that imitate package delivery services.
The North Korean threat group Kimsuky has expanded its attack methods by distributing mobile malware via weaponized QR codes. This tactic targets users through phishing sites that imitate package delivery services.
Security researchers identified this malicious campaign in September 2025. Victims received smishing messages with links redirecting them to fake delivery tracking websites hosting QR codes. These QR codes trick users into downloading infected Android applications.
The malware is a new variant of "DOCSWAP," documented earlier in 2025, featuring enhancements such as a native decryption function and varied decoy behaviors.
Enki analysts identified the malicious application being distributed from a command and control server located at 27.102.137[.]181. It impersonated legitimate services like CJ Logistics and cryptocurrency authentication systems to deceive victims.
When accessed from a computer, the phishing links display a message stating "For security reasons, you cannot view this page from a PC" with a QR code. Scanning this code on a mobile device initiates the download of a supposed security app. However, accessing the link directly from an Android device displays fake security scanning screens, prompting users to install a "security app" for authentication.
The malicious application uses Base64-encoded URLs and server-side logic to serve different content based on the user's device, complicating detection.
Once installed, the malware operates in multiple stages, initially requesting extensive permissions, including file access, phone, SMS, and location data.
The North Korean threat group Kimsuky has expanded its attack methods by distributing mobile malware via weaponized QR codes.
The downloaded APK file, named "SecDelivery.apk," contains an encrypted APK stored as "security.dat." This variant employs a native library called "libnative-lib.so" for decryption, involving three steps: bit inversion, 5-bit left rotation, and XOR operations with a 4-byte key (541161FE in hex).
The malware establishes persistence through a sophisticated service registration process. After decryption, the application launches SplashActivity, which loads encrypted resources, requests permissions, and registers a service called MainService.
To maintain operation, the malware configures intent filters that automatically execute MainService upon device reboot or power connection. The AndroidManifest.xml file defines these triggers as "android.intent.action.BOOT_COMPLETED," "android.intent.action.ACTION_POWER_CONNECTED," and "android.intent.action.ACTION_POWER_DISCONNECTED."
The application displays a fake authentication screen asking users to enter a delivery tracking number and verification code. The hardcoded delivery number "742938128549" is included in the initial phishing message.
After authentication, the app shows the official delivery tracking website, convincing users they have installed a legitimate application while the malicious service runs in the background.
The embedded RAT supports 57 commands allowing comprehensive device control. It communicates with the command and control server using a format with length headers, null bytes, and Gzip-compressed payloads.
The command parsing logic uses "10249" as a delimiter, enabling actions like audio and video recording, file management, location tracking, call log collection, contact list theft, SMS interception, remote command execution, and live keylogging.
The keylogger operates through Android's Accessibility Service, capturing app icons, package names, event text, and timestamps, which are then compressed and Base64-encoded before transmission.
Researchers discovered connections between this campaign and previous Kimsuky operations through shared infrastructure, including the distinctive "Million OK !!!!" string on command and control servers.
Korean-language comments in the HTML code and error messages further link the activity to North Korean threat actors.
The campaign demonstrates Kimsuky's continued evolution in mobile threats, targeting smartphones with sensitive financial and personal information.
Based on reporting by Cyber Security News.