DocSwap
DocSwap is an Android malware family first documented in 2025 that masquerades as legitimate mobile applications, including a document-viewing authentication app and later delivery/security-themed apps such as CJ Logistics lures. The malware has been linked in reporting to the North Korean threat actor Kimsuky, while S2W assessed the early sample as likely tied to a North Korea-linked cluster it tracks as puNK-004. Distribution has been observed via QR-code phishing and phishing/smishing infrastructure, including fake logistics sites and mobile-optimized lure pages. One reported package name was com.security.library, and later campaign reporting identified a malicious APK named SecDelivery.apk downloaded from 27.102.137[.]181.
Technically, DocSwap decrypts an embedded payload and dynamically loads it. Early reporting described XOR decryption of an embedded file named security.db followed by DEX loading; later reporting described an encrypted embedded APK/security.dat decrypted via a native library using a multi-step routine. The malware communicates with command-and-control infrastructure over sockets; one reported C2 was 27.102.137[.]181:50005. Reporting states the RAT supports up to 57 commands.
Observed capabilities include keylogging via Android Accessibility Services; SMS theft including sender/receiver, message body, and timestamp; collection of messages, calls, files, contacts, call logs, and device/network information; camera and microphone recording; screenshot and audio/video capture; file upload/download and deletion; remote command execution; and location tracking. Mentioned permissions include READ_SMS, RECEIVE_SMS, WRITE_EXTERNAL_STORAGE, LOCAL_MAC_ADDRESS, and READ_PRIVILEGED_PHONE_STATE, with broader reporting also noting requests for storage, phone, and location access.
The malware appears primarily aimed at South Korean mobile users based on Korean-language strings, Korean-themed lures, and impersonation of South Korean brands such as CJ Logistics, Naver, and Kakao. Infrastructure observations included CoinSwap-themed phishing content on a C2 address, which contributed to the DocSwap name, and later Naver-themed elements plus the string "Million OK !!!!," noted as resembling prior Kimsuky phishing infrastructure. Reported sample hashes include MD5 3ccfe58b8e0b5ca96cac4e9394567515 and SHA256 bf134495142d704f9009a7d325fb9546db407971ade224e3718a84254e9ff03e for an early sample.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On January 21, 2025, a malicious app named “문서열람 인증 앱” (Document Viewing Authentication App) was identified. This app, a new type of malware not previously observed, impersonates a Document-viewing authentication app. Additionally, a phishing page masquerading as CoinSwap was found at the C2 address, leading to the app being named DocSwap.
On January 21, 2025, a malicious app named “문서열람 인증 앱” (Document Viewing Authentication App) was identified. This app, a new type of malware not previously observed, impersonates a Document-viewing authentication app. Additionally, a phishing page masquerading as CoinSwap was found at the C2 address, leading to the app being named DocSwap.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
3 techniques
Stealth
It decrypts the “security.db” file within the package using an XOR operation and dynamically loads a DEX file.
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
DocSwap has checked for the WRITE_EXTERNAL_STORAGE permission. Drinik can request the READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE Android permissions. TangleBot can request permission to view files and media. VajraSpy has also requested for android.permission.WRITE_EXTERNAL_STORAGE and android.permission.READ_EXTERNAL_STORAGE.
Collection
3 techniques
Collection
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android spyware attributed in the report to Kimsuky for espionage operations, delivered via QR phishing.
Android RAT delivered via QR-phishing; decrypts an embedded encrypted APK and launches a malicious service providing remote-access capabilities.
Android remote access trojan distributed via QR codes (quishing) that, once installed, provides access to messages, calls, files, camera, and microphone.
Android infostealer malware distributed via QR code phishing, masquerading as a logistics app to steal user data.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.