Kimsuky is a North Korea–linked advanced persistent threat (APT) group known for espionage, credential theft, and targeted malware campaigns against government, defense, and tech sectors. They have been observed using sophisticated social engineering and phishing tactics to compromise victims’ devices.
What Is the DocSwap Android Malware?
DocSwap refers to a family of malware variants targeting Android devices. In this campaign, DocSwap is a Remote Access Trojan (RAT) — a type of malware that gives attackers deep control over infected smartphones, letting them spy on, control, and extract data from the device.
🛠 Capabilities of the DocSwap Malware
Once installed, DocSwap can:
- Log keystrokes and capture user interactions.
- Record audio and potentially camera feeds.
- Remotely execute commands.
- Upload/download files and exfiltrate sensitive data.
- Collect contacts, SMS messages, call logs, installed apps, location data.
These capabilities make it highly invasive — essentially turning the phone into a remote surveillance platform.
How the Attack Works (Delivery Mechanism)
Instead of traditional email links or app store exploits, Kimsuky uses QR code-based phishing with malicious redirection:
Step-by-Step Infection Chain
- Phishing Message (Smishing/Email):
Victims receive a message impersonating a legitimate delivery service (e.g., CJ Logistics), urging them to check a delivery tracking page. - QR Code Redirect:
The link points to a phishing site that looks like a real delivery portal. On desktop, it displays a QR code asking the user to scan it with their phone. - Malicious APK Download:
Scanning the QR leads the phone to download an Android APK (often named something likeSecDelivery.apk), which pretends to be a “security” or “delivery tracking” app. - Permission Prompt & Fake Warnings:
Android blocks installations from unknown sources by default — so attackers display fake messages saying the app is safe and required due to “international customs/security policies.” - Decryption & Execution:
The downloaded APK contains an encrypted malware payload inside it. Once installed, it decrypts and launches DocSwap using a native decryption routine, making detection harder.
Social Engineering Tricks Used
Fake Authentication Screens
Instead of immediately installing malware, the app displays a realistic “OTP/delivery verification” screen. Users are prompted to enter a hard-coded tracking number and a fake verification code — making it look like a legitimate tracking process while malware runs in the background.
Legitimate Webview Display
After submitting the fake authentication, the app then loads a real CJ Logistics tracking site inside the app’s webview, reinforcing the illusion that everything is legitimate.
Technical Execution and Evasion
Permissions Abused
The app requests extensive permissions — including access to file storage, internet, device state, contacts, SMS, and possibly camera and audio — which are often silently granted by unsuspecting users.
Embedded APK and Native Code
A key evolution with this DocSwap variant is that it decrypts the malware payload using native code, rather than simple Java methods. This makes static detection by security scanners much harder.
Broader Infrastructure and Tactics
Additional Phishing Sites
Researchers have found credential harvesting sites mimicking other Korean platforms like Naver and Kakao, suggesting overlapping infrastructure with earlier Kimsuky campaigns.
Multiple BOTNET / RAT Control Servers
The campaign uses several command and control servers and has been linked to other fake apps — including VPN apps and airdrop scam apps — indicating a multi-pronged attack infrastructure.
Why This Is Dangerous
Deep Device Control
Once installed, the RAT can fully surveil and interact with the user’s device without their knowledge. This compromises privacy, credentials, business communications, and personal data.
Social Engineering Success
Using QR codes and trusted service impersonation increases the likelihood that normal users will trust and install the malware.
Infrastructure Overlap
Links to previous phishing operations show a persistent threat actor with evolving tactics, making this part of a broader espionage and credential theft strategy.
How Users & Organizations Can Defend
- Verify sender and URLs — especially when text messages include QR codes.
- Avoid installing apps from unknown sources — only install from trusted official app stores.
- Mobile security tools — use EDR/anti-malware solutions that monitor for suspicious permissions and RAT behavior.
- Train users — on phishing recognition, especially smishing and QR code scams.
- Network defenses — block known malicious IPs/domains associated with this campaign.
