Kimsuky Hackers Attacking Users via Weaponized QR Code to Deliver Malicious Mobile App

Kimsuky has deployed an evolved DOCSWAP Android malware variant in a QR-code-based smishing campaign that lures victims to fake delivery/tracking sites. The APK (SecDelivery.apk) contains an encrypted payload decrypted by a native library (libnative-lib.so) and registers a persistent service (MainService) triggered on boot and power events; it supports 57 RAT commands for audio/video capture, file management, location and call/SMS exfiltration, and Accessibility-based keylogging. Researchers tied the campaign to prior Kimsuky operations via shared infrastructure and artifacts including a C2 at 27.102.137.181 and Korean-language indicators.