Tag: docswap

2 Attack Reports | 0 Vulnerabilities

Attack reports

Kimsuky Distributing Malicious Mobile App via QR Code

A new campaign by Kimsuky involves distributing malicious mobile apps through QR codes and phishing websites. The apps, masquerading as delivery services, VPNs, and cryptocurrency tools, decrypt an embedded APK to deploy a RAT with extensive capabilities. The malware uses a native decryption functi…
rat
phishing
keylogging
apk
dprk
mobile malware
decryption
qr code
docswap
2025-12-16
Published: December 16, 2025
Downloadable IOCs: 12

Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer

A new malware called DocSwap, disguised as a document viewing authentication app, was discovered targeting South Korean mobile users. The malware, linked to a North Korean APT group, performs keylogging and information theft through accessibility services. It decrypts an obfuscated APK file, execut…
apt
north korea
south korea
2025-04-12
dpkr
docswap
accessibility services
Published: April 12, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports