A group of hackers with links to the North Korean regime uploaded Android spyware onto the Google Play app store and were able to trick some people into downloading it, according to cybersecurity firm Lookout.
In a report published on Wednesday, and exclusively shared with TechCrunch ahead of time, Lookout details an espionage campaign involving several different samples of an Android spyware it calls KoSpy, which the company attributes with “high confidence” to the North Korean government.
At least one of the spyware apps was at some point on Google Play and downloaded more than 10 times, according to a cached snapshot of the app’s page on the official Android app store. Lookout included a screenshot of the page in its report.
In the last few years, North Korean hackers have grabbed headlines especially for their daring crypto heists, like the recent theft of around $1.4 billion in Ethereum from crypto exchange Bybit, with the goal of furthering the country’s banned nuclear weapons program. In the case of this new spyware campaign, however, all signs point to this being a surveillance operation, based on the functionality of the spyware apps identified by Lookout.
The goals of the North Korean spyware campaign are not known, but Christoph Hebeisen, Lookout’s director of security intelligence research, told TechCrunch that with only a few downloads, the spyware app was likely targeting specific people.
According to Lookout, KoSpy collects “an extensive amount of sensitive information,” including: SMS text messages, call logs, the device’s location data, files and folders on the device, user-entered keystrokes, Wi-Fi network details, and a list of installed apps.
KoSpy can also record audio, take pictures with the phone’s cameras, and capture screenshots of the screen in use.
Lookout also found that KoSpy relied on Firestore, a cloud database built on Google Cloud infrastructure to retrieve “initial configurations.”
Google spokesperson Ed Fernandez told TechCrunch that Lookout shared its report with the company, and “all of the identified apps were removed from Play [and] Firebase projects deactivated,” including the KoSpy sample that was on Google Play.
“Google Play automatically protects users from known versions of this malware on Android devices with Google Play Services,” said Fernandez.
