North Korea’s Kimsuky Upgrades DOCSWAP Malware to Hijack Smartphones via QR Codes

North Korea’s Kimsuky has rolled out an evolved version of the DOCSWAP malware to hijack smartphones, using QR codes and smishing to deploy a sophisticated Remote Access Trojan (RAT). First identified in March 2025, the campaign resurfaced with new upgrades in which the malware is delivered via phishing websites that lure victims with QR codes and notification pop-ups.

The latest iteration features a major technical overhaul, including a new native decryption function and diversified decoy behaviour, designed to hinder analysis. Once installed, the app runs quietly in the background to decrypt an embedded encrypted APK and then launches a service that provides RAT capabilities, enabling potential data theft, monitoring, and exfiltration without user awareness.

According to ENKI WhiteHat Threat Research Team, the operators left fingerprints on the command-and-control infrastructure, including a “Million OK!!!” string and Korean-language clues in distribution sites that link the activity to the DPRK-nexus threat actor. The report notes the growing trend of targeting mobile devices as primary intelligence sources, and users are advised to avoid unknown QR codes and third-party apps prompted by unsolicited texts.