Android Users Hit by Malware Disguised as Relaxation Programs

A sophisticated Android attack targeting devices in South Korea has been revealed, using Google Find Hub to remoterly wipe data and track victims. Threat actors disguised as psychological counsellors and North Korean human rights activists distributed malware masquerading as stress-relief programs, marking a notable escalation in state-linked activity attributed to the KONNI APT group.

The Genians Security Center (GSC) traces this campaign to KONNI, which has overlapping infrastructure with Kimsuky and APT37; according to The Multilateral Sanctions Monitoring Team (MSMT), KONNI and Kimsuky are separate but closely associated groups.

Investigators found that the Stress Clear[.]zip MSI package runs on Windows and delivers modules such as RemcosRAT, QuasarRAT, and RftRAT, enabling remote access, credential theft, and data exfiltration, while Find Hub was abused to issue remote wipe commands on compromised Google accounts.

The campaign demonstrates how threat actors exploit legitimate platform features to conduct espionage and data destruction, underscoring the need for enhanced account security, real-time detection, and verification of remote wipe requests.