Spyware
KoSpy
According to Lookout, this spyware was first observed in March 2022 and remains active with new samples still publicly hosted.
KoSpy is a Android spyware operated by APT37.
Background
Per Lookout, this spyware was first spotted in March 2022 and is still active, with fresh samples publicly hosted to this day. It relies on a two-stage C2 setup that pulls its initial configuration from a Firebase cloud database. Through dynamically loaded plugins, KoSpy can harvest a wide range of data, including SMS messages, call logs, location, files, audio, and screenshots. It includes Korean-language support, and its samples have been spread via Google Play as well as third-party stores like Apkpure.
Source: Malpedia (Fraunhofer FKIE).