A North Korea-linked intrusion set abused Google's Find Hub device-tracking service to remotely factory-reset victims' Android phones after stealing their account passwords through tax-themed phishing, according to a Monday report from Korean cybersecurity firm Genians.
The campaign, attributed to the Konni cluster that overlaps with APT37 and Kimsuky tradecraft, marks the first documented case in South Korea of attackers using a legitimate lost-device wipe feature to silence victims while malware spreads through hijacked KakaoTalk sessions on compromised PCs.
Attack chain
Genians said spear-phishing emails impersonating the National Tax Service carried malicious installers disguised as requests to explain undeclared income. Once a Windows PC was infected, operators logged keystrokes, harvested Google and Naver credentials saved in browsers, and monitored victims through PC webcams to time attacks when targets left home.
With Google accounts in hand, attackers opened Find Hub, confirmed handset GPS locations showed victims away from devices, and issued repeated remote-reset commands. Photos, contacts and messenger data on the phones were erased, muting alerts that might have warned users about KakaoTalk messages sent from stolen desktop sessions.
Propagation through KakaoTalk
After wipes, Konni actors messaged victims' contacts from logged-in KakaoTalk PC clients, distributing archives labeled as stress-relief tools. Genians traced one September chain through a counselor working with North Korean defector youth, showing how trusted relationships become distribution nodes.
Secondary Windows payloads included commercially leaked remote-access trojans researchers track as Remcos and Quasar variants. None of the steps required zero-day mobile exploits; credential theft and social engineering did the heavy work.
Defensive guidance
Genians urged turning on two-factor authentication for Google accounts, avoiding browser password vaults for high-value identities, and treating tax or police email attachments as hostile until verified through official portals. Google recommended passkeys or its Advanced Protection Program for at-risk users.
Government incident channels have not released victim counts. National Intelligence Service officials routinely warn that Pyongyang groups refine financial and identity theft alongside traditional espionage. For ordinary users, the lesson is specific: a phone wipe initiated from the cloud can be an attack, not a mistake.
Enterprise response
Financial firms and law practices already on heightened alert for Kimsuky lures said they would add Find Hub reset notifications to their help-desk playbooks. Mobile carriers reported a small uptick in SIM-restoration calls tied to the campaign. Security vendors expect copycat attempts while the technique remains novel in regional threat feeds.