Researchers have uncovered KoSpy, a new surveillance tool attributed to the North Korean APT group ScarCruft (APT37). Targeting both Korean and English-speaking users, this malware masquerades as utility apps like "File Manager" and "Kakao Security" to deceive victims.

KoSpy can steal sensitive information, including SMS messages, call logs, location, photos, and more, by using plugins and abusing accessibility services. Though Google Play has removed the apps, users should remain cautious when downloading from third-party sources.