The National Telecommunication and Information Security Board (NTISB) has alerted government institutions and the general public about the presence of dangerous apps on the Google Play Store that are stealing users’ private data.

The NTISB, which operates under the Cabinet Division, has issued an official advisory highlighting how some apps disguised as file managers or security tools are secretly accessing users’ sensitive information. These malicious apps have the ability to steal call logs, audio recordings, videos, screenshots, locations, and even financial details stored on mobile phones.

According to the advisory, these cyber threats are being orchestrated by North Korean hacker groups known as APT-37 and APT-43. These groups are behind two specific forms of malware: the Quaspy spyware, which can access various types of media and communication data, and the Anatsa (also known as T-Bot) banking Trojan, which targets users’ passwords and financial information.

Despite Google removing dozens of such harmful apps from the Play Store in March, reports reveal that these apps had already been downloaded over 220,000 times. Their widespread presence underscores the urgent need for vigilance among Android users.

The NTISB has issued the following key recommendations for all ministries, public institutions, and general users:

Immediately delete any suspicious apps from smartphones.
Install apps only from trusted developers and verify app permissions before installation.
Keep Google Play Protect enabled to automatically detect and block harmful applications.
Stay informed and ensure full implementation of the advisory to protect against potential financial losses and data theft.

This advisory aims to protect national institutions and the general public from increasingly sophisticated cyber threats. The NTISB emphasized that compliance with cybersecurity guidelines is essential to prevent the leakage of personal and institutional information.