AgentNK is a malicious Android application attributed by the source to the Konni threat group based on similarities to an app used in 2019. It masquerades as a cryptocurrency-related application, while the earlier app impersonated a security product called App Protect. The newer sample reuses code, variables, and a distinctive string from the older Konni application. Its code also interprets and executes commands received from command-and-control infrastructure. The campaign was assessed as likely intended to steal victims’ cryptocurrency.