UN Panel of Experts S/2024/215
Malicious Android apps disguised as e-commerce, Google Authenticator, anti-virus and payment apps
Para 144: “Kimsuky continues to create malicious Android mobile applications disguised as legitimate Android apps, including a popular e-commerce service, security plug-in Google Authenticator, anti-virus programme and payment service app, in order to steal information from infected devices. ... The malicious applications were likely distributed via spearphishing or smishing (see annex 59.1 for additional information).”