Kimsuky Expands Mobile Attacks with Weaponized QR Codes

Kimsuky, a North Korea-linked threat actor, is conducting an active campaign that uses weaponized QR codes and phishing websites to distribute trojanized Android apps acting as Remote Access Trojans; these samples use encrypted payloads that are decrypted and loaded at runtime to evade static detection and target mobile users and enterprises. Zimperium highlights the threat of QR-based delivery, notes that its Mobile Threat Defense and Mobile Runtime Protection detect and block these attacks (reporting 90% detection of public IOCs via on-device dynamic detection), and emphasizes the importance of runtime and QR-code protections to mitigate this mobile-native attack vector.