Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App
The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics (formerly CJ Korea Express).
"The threat actor leveraged QR codes and notification pop-ups to lure victims into installing and executing the malware on their mobile
https://thehackernews.com/2025/12/kimsuk...lware.html
The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics (formerly CJ Korea Express).
"The threat actor leveraged QR codes and notification pop-ups to lure victims into installing and executing the malware on their mobile
https://thehackernews.com/2025/12/kimsuk...lware.html
I am the official HF Help Bot. You might get an automated PM from me with some helpful information.
Please read our Help Docs.
Please read our Help Docs.