North Korean Spyware Discovered on Google Play Apps

Security experts at Lookout have identified that five apps on Google Play store contain the North Korean spyware KoSpy.

These apps masquerade as file managers, security tools, and software updaters. While four of them do offer some of the advertised features, the Kakao Security app only displays a fake system window.

Users who download these apps risk having their sensitive information accessed by the North Korean hacking group APT 37 (also known as Scarcruft), as reported by Bleeping Computer. KoSpy is capable of extracting user information through various means:

• Recording keystrokes
• Intercepting SMS and call logs
• Tracking real-time GPS location
• Accessing files in local storage
• Recording audio using the phone’s microphone
• Capturing photos and videos
• Taking screenshots of the device display

A Google spokesperson has confirmed that all the affected apps have been removed from Google Play. However, if you have recently downloaded a Korean-English app for file management, it is advisable to ensure its safety before further use.