QiAnXin's RedDrip team analyzed Android malware activity targeting users in South Korea with fake versions of common mobile apps such as KakaoTalk. Delivery used SMS or instant-message short links that led either directly to malicious APKs or to fake app-download pages, including domains such as oaass-torrent.com and download-apks.com. The trojan hid by opening the legitimate KakaoTalk app when present, then collected contacts, SMS records, installed-app lists, SD-card directory data, phone information, and audio recordings. Command and control used HTTP polling of /manager/files/To_[IMEI].txt on 2.56.151.8, and the researchers found strong code overlap with previously disclosed KONNI Android malware that ESTsecurity had associated with Kimsuky.