Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App

The North Korean threat actor known as Kimsuky has been linked to a campaign that distributes a new Android malware variant called DocSwap via QR codes hosted on phishing sites spoofing CJ Logistics. The group employs QR codes and alert pop-ups to coax victims into installing a malicious app, which decrypts an embedded APK and launches a RAT-enabled service.

The attacker then uses a delivery-number OTP deception, with a hard-coded shipment number 742938128549, and prompts the user to enter a six-digit code before revealing a WebView to the legitimate CJ Logistics tracking site. ENKI said the malware connects to an attacker-controlled server at 27.102.137[.]181:50005 to receive up to 57 commands that allow keystroke logging, audio capture, camera recording, file operations, and location, SMS, contact, call log, and installed-app data exfiltration.

Some samples masquerade as other delivery and security-related apps, and phishing sites imitating South Korean platforms such as Naver and Kakao are used to harvest credentials. According to ENKI, the threat actor repackages legitimate APKs with malicious functionality to enable continued control over infected devices.