KoSpy

KoSpy is an Android surveillance tool attributed to the North Korean actor APT37 (ScarCruft / Reaper), disclosed by Lookout in 2025. Samples pose as utility apps (File Manager, Software Update, security helpers) and use a two-stage C2: the implant first pulls its live configuration and real C2 address from a Google Firebase project (hence the *.appspot.com indicators such as project-27ef0, smart-743cf and version-25b53), then beacons to the operator server. It collects SMS, call logs, location, audio recordings, screenshots, keystrokes and installed-app lists, fetching payloads on demand. Targets Korean- and English-speaking victims. APT / state-aligned.