Beware of North Korean Hackers DocSwap Malware Disguised As Security Document Viewer

A sophisticated malware campaign targeting mobile users in South Korea has been uncovered, with clear links to North Korean threat actors.

The malicious application, masquerading as a “Document Viewing Authentication App” (문서열람 인증 앱).

This malicious app was identified through VirusTotal on January 21, 2025, and has been actively stealing sensitive information from compromised devices.

While the researchers at S2W Threat Research and Intelligence Center detected that the malware, which they have named “DocSwap” after discovering a phishing page impersonating CoinSwap at the command and control infrastructure.

The researchers noted that the malicious app was first signed on December 13, 2024, and represents a previously unidentified type of threat specifically designed to target South Korean users.

The sophisticated malware employs a multi-stage infection process that begins with decrypting an obfuscated file within the package.

“The malicious app performs an XOR (0xCC) operation on the ‘security.db’ file in a subdirectory, which drops an APK file and loads the DEX file stored within it,” explained the report detailing the threat.

Upon execution, DocSwap aggressively requests numerous permissions including access to call logs, contacts, SMS messages, external storage, and phone capabilities.

It persistently generates notifications asking users to enable accessibility services with messages like “To ensure proper functionality, please enable accessibility permissions.”

The application ensures persistence by registering for boot-related intents including BOOT_COMPLETED, ACTION_POWER_CONNECTED, and ACTION_POWER_DISCONNECTED, allowing it to survive device restarts.

It also uses the StartForeground API to maintain a constant presence with notifications stating “Tap to view more details or stop the app.”

Technical Capabilities and Command Structure

DocSwap communicates with a hardcoded command and control server at 204.12.253[.]10:6834, receiving instructions through a sophisticated command structure.

The malware supports 57 different commands enabling extensive surveillance and data exfiltration capabilities.

Key components of the decryption mechanism reveal the attackers’ techniques:-

public static void dumpFile(String assetsPath, String destPath) {
    File destFile = new File(destPath);
    if(!new File(destFile.getParent()).exists())
        new File(destFile.getParent()).mkdirs();
    try {
        if(!destFile.exists())
            destFile.createNewFile();
        InputStream inputStream0 = MyApp.getInstance().getAssets().open(assetsPath);
        FileOutputStream out = new FileOutputStream(destFile);
        byte[] tmpbt = new byte[0x400];
        int v;
        while((v = inputStream0.read(tmpbt)) != -1) {
            for(int i = 0; i < 0x400; ++i) {
                tmpbt[i] = (byte)(tmpbt[i] ^ 0xFFFFFFFC9);
            }
            out.write(tmpbt, 0, readCount);
        }

The keylogging functionality captures extensive information, including app package names, app icons, and text from user interactions.

This data is transmitted to the C2 server and stored locally in a path that follows the pattern: “/data/data/com.security.library/Security/download_{dd-mm-yyyy}.dat”.

S2W has attributed this campaign to a North Korean threat actor they track as puNK-004, noting similarities to infrastructure previously used by the Kimsuky group.

Security researchers recommend extreme caution when installing mobile applications, particularly those requesting accessibility permissions or claiming to be document authentication tools from uncertain sources.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free