Archive — US — techcrunch
North Korean government hackers snuck spyware on Android app store
North Korean hackers uploaded spyware called KoSpy to the Google Play store, tricking users into downloading it. The spyware collects sensitive information and is suspected to target specific individuals, particularly in South Korea. Lookout, the cybersecurity firm behind the report, attributed the campaign to the North Korean government.
Key points
- North Korean hackers linked to government uploaded KoSpy spyware to Google Play.
- Spyware has been downloaded over 10 times, indicating targeted surveillance.
- KoSpy collects sensitive data: SMS, call logs, location, keystrokes, and can activate cameras.
- Lookout used evidence of language and app names to infer targets may be South Koreans.
- Google removed malicious apps and protects users from known malware.
Why it matters
- This incident highlights the ongoing threat of state-sponsored cyber espionage.
- Historically, North Korean hackers have been involved in crypto heists and cyber warfare.
- 2025 IT Trends emphasize the need for advanced security measures against targeted spyware attacks.
The discovery of KoSpy reinforces the need for vigilance in app security, especially as state-sponsored cyber threats evolve and adapt to exploit user trust in official platforms.