North Korean hacker group KONNI first uses Google Find Hub feature to remotely erase Android device data

ChainCatcher message: Security researchers have discovered that the North Korean hacker group KONNI has developed a new attack method, utilizing Google’s Find Hub asset tracking feature to remotely erase data on Android devices for the first time.
Attackers disguise themselves as psychologists and human rights activists to distribute malicious software called Stress Relief Program via the KakaoTalk messaging platform in South Korea. Once victims execute these files, attackers steal Google account credentials, use the Find Hub feature to track device locations, and perform remote resets, resulting in personal data being deleted.
This attack is confirmed to be a follow-up operation of KONNI APT activities, which are closely linked to the North Korean government-backed groups Kimsuky and APT 37. Security experts recommend users strengthen account security, enable two-factor authentication, and remain cautious of files received through instant messaging tools.