North Korean Hackers Use Google Tool to Wipe South Korean Devices

A North Korean-linked hacking group has exploited Google's Find Hub service to remotely wipe data from Android devices in South Korea, marking the first confirmed instance of a state-sponsored actor abusing the legitimate tool for destructive purposes, according to cybersecurity researchers at Genians Security Center.

The attacks, detected in September 2025, targeted individuals including a psychological counselor supporting North Korean defectors. Perpetrators impersonated government agencies and trusted contacts to distribute malware disguised as stress-relief programs via spearphishing emails and the popular KakaoTalk messaging app. Once installed on victims' Windows computers, the malware stole Google account credentials, enabling attackers to access Find Hub—a feature designed to help users locate, lock, or erase lost devices—and track real-time locations before issuing remote reset commands.

Researchers detailed how the operation unfolded. Initial infections began with emails spoofing South Korea's National Tax Service, containing digitally signed MSI installer files like Stress Clear.msi. These appeared as standard installation windows but secretly deployed AutoIt scripts...