Kimsuky Leverages QR Phishing to Spread Android Malware in Fake Delivery App Campaign (2025)

In June 2025, the North Korean threat group Kimsuky launched a sophisticated phishing campaign using QR codes that directed victims to malicious websites impersonating South Korean logistics giant CJ Logistics. Unsuspecting users who scanned the QR codes and interacted with fake prompts were tricked into downloading and executing the DocSwap Android malware. The malware enabled unauthorized access to sensitive device data and communications, potentially allowing attackers to conduct surveillance and lateral movement within enterprise environments. The incident highlights the versatility of Kimsuky’s tactics and the growing risk to mobile users targeted via supply-chain or delivery-themed phishing.

Kimsuky's campaign reflects a broader industry-wide uptick in mobile phishing and social engineering attacks that leverage QR codes and trusted brands. This case demonstrates how advanced persistent threat actors are pivoting to circumvent traditional detection, pushing organizations to adopt holistic mobile and endpoint security strategies.

This incident underscores the urgent need for organizations to address the rising threat of mobile-focused phishing attacks, especially those using QR codes as an initial vector. As adversaries increasingly target the mobile supply chain and exploit user trust in known brands, swift action is required to bolster mobile endpoint defenses and security awareness.