The rogue state uploaded three spying apps to Google Play’s app store in January, according to researchers from security company McAfee. Two of the apps were disguised as security apps, while the third was disguised as an app that provided information about food ingredients. But hidden functions in the apps allowed North Korean actors to steal personal photos, contact lists, and text messages from the phones they were installed on, along with device information.
The Google Play apps were targeted at specific individuals–primarily North Korean defectors–by targeting them on Facebook. The apps were reportedly on the Google Play store until March before they were removed by Google. At the time of their removal, the apps had about 100 downloads in total.