One of the malicious apps masqueraded as a file manager and had more than 10 downloads, according to the cybersecurity firm Lookout. The app contained Android spyware called KoSpy, which Lookout attributes to the North Korean hacking group APT37. It’s capable of collecting a device’s SMS messages, call logs, location, files, and more.
Lookout says the apps it found have since been removed from the Google Play Store.