Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7) +--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445) +---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89) +---- Thread: Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App (/showthread.php?tid=6316777)

Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App - Stanley - Dec 29, 2025 Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics (formerly CJ Korea Express). "The threat actor leveraged QR codes and notification pop-ups to lure victims into installing and executing the malware on their mobile https://thehackernews.com/2025/12/kimsuky-spreads-docswap-android-malware.html