Back to threat feeds
Malware
North Korean Hackers Sneak KoSpy Spyware into Google Play 10+ Victims
North Korean Hackers Infiltrate Google Play with KoSpy Spyware in Targeted Surveillance Campaign
Continue reading
North Korean Hackers Infiltrate Google Play with KoSpy Spyware in Targeted Surveillance Campaign
Continue reading
A cyber-espionage sophistication, state-linked North Korean hackers successfully uploaded Android spyware to Google’s official Play Store, masquerading as benign apps to surveil victims, cybersecurity researchers revealed this week. The campaign, attributed to Pyongyang’s notorious hacking apparatus, underscores the growing audacity of state-sponsored actors in exploiting trusted digital platforms.
On Wednesday, cybersecurity firm Lookout exposed a long-running espionage operation involving malware dubbed “KoSpy,” which it linked to North Korean government hackers with “high confidence.” The spyware, disguised as a “File Manager” app, was hosted on Google Play and third-party store APKPure, marking one of the rare instances of North Korean malware penetrating official app stores.
According to Lookout’s report, at least one KoSpy-laden app reached Google Play, which was downloaded “more than 10 times” before removal. A cached snapshot of the app’s store page, reviewed by TechCrunch, showed a seemingly innocuous utility tool with no overt signs of malice. Researchers also identified similar apps on APKPure, though the platform claimed it _“did not receive an email”_ from Lookout about the findings.
Google swiftly removed the apps and deactivated associated Firebase projects—a cloud database service used by KoSpy to retrieve commands—but declined to comment on whether it agreed with Lookout’s attribution to North Korea.
KoSpy operates as a potent surveillance tool, harvesting vast swaths of sensitive data from infected devices, including:
The malware also enables attackers to record ambient audio, capture photos using the device’s cameras, and take screenshots of active apps—capabilities typically reserved for high-tier spyware like Pegasus. Notably, KoSpy leverages Google’s Firestore, a legitimate cloud service, to dynamically update its configuration, allowing operators to evade detection by blending into routine network traffic.
_“The use of Firestore is clever,”_ said Christoph Hebeisen, Lookout’s director of security intelligence research. _“It lets the malware communicate with command servers under the guise of normal Google Cloud activity, making it harder for defenders to spot.”_
Lookout’s attribution to North Korea hinges on multiple technical and strategic factors:
_“North Korean actors are uniquely motivated. They’re not just after money; they’re also collecting information to maintain regime stability,”_ said Alemdar Islamoglu, a senior researcher at Lookout.
Despite its presence on public app stores, KoSpy’s low download count suggests a highly targeted operation. Researchers believe victims were lured via spear-phishing or directed to the app through personalized links—a tactic commonly used in state-sponsored espionage.
_“This wasn’t about mass infection,”_ Hebeisen explained. _“The goal was to compromise specific individuals, possibly dissidents, defectors, or policymakers, with minimal noise.”_
The incident highlights critical vulnerabilities in app store ecosystems, even as companies like Google tout robust security measures. While Google Play’s automated scanners detected and removed KoSpy post-discovery, its initial approval raises questions about gaps in preemptive vetting.
_“The fact that North Korean hackers repeatedly slip into official stores shows how challenging it is to keep up with malicious actors,” said Hebeisen. “They’re agile, well-resourced, and willing to experiment.”_
Third-party stores like APKPure, which lack Google’s scrutiny, remain even riskier. Despite APKPure’s claims of rigorous checks, researchers regularly find malware hosted on such platforms.
While Pyongyang’s hackers are infamous for funding nuclear ambitions through cryptocurrency thefts, KoSpy represents a pivot toward strategic surveillance. Experts speculate the regime may be monitoring defectors and activists abroad, gathering geopolitical intelligence amid escalating tensions with South Korea and the U.S., and testing new tools for future attacks.
_“Cyber operations are a low-cost, high-reward tool for North Korea,”_ said Priscilla Moriuchi, a former NSA analyst specializing in East Asian threats. _“They can deny plausibility while achieving multiple financial, political, and military objectives.”_
Lookout and Google urge users to:
Google emphasized that its Play Protect service now blocks known KoSpy variants on devices with Google Play Services enabled.
The KoSpy campaign underscores the blurred lines between cybercrime and cyberwarfare, with nation-states exploiting the same tools as criminal gangs. The incident is a stark reminder for app stores that even robust defenses can be outmaneuvered by determined adversaries.
As Hebeisen noted, _“The North Koreans aren’t slowing down. If anything, they’re getting better.”_
For users, the lesson is clear: trust, but verify.
This Threatfeed was updated to include Google’s statement and APKPure’s response.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
