North Korean Threat Actor Spreads Malware via QR Codes

Kimsuky (a North Korean APT) is using QR-code phishing pages that impersonate delivery services to coerce victims into installing malicious mobile apps; researchers found four malicious applications served from 27.102.137.181 and link the activity to smishing/phishing initial access. The technique allows the actor to bypass desktop defenses by moving victims to mobile devices and relies on social engineering to get users to install the malware, posing a targeted threat to organizations and individuals receiving unsolicited delivery notifications.