NagaPocker Mobile Credential Theft Campaign: QR Code Phishing Attacks Targeting Ukraine

Threat Summary

This OTX pulse reveals a sophisticated mobile credential theft campaign leveraging QR codes as a primary attack vector. The threat actor is using QR codes with URL shorteners to conceal malicious destinations, in-app deep links to steal credentials, and direct malicious app downloads to bypass app store security. The campaign primarily targets the Ukrainian financial, technology, and retail sectors with geopolitical implications given the Russia-Ukraine conflict. The average of 11,000 daily detections of malicious QR codes indicates a significant and active operation. The objective appears to be credential harvesting and potential financial fraud or espionage against Ukrainian entities.

Threat Actor / Malware Profile

Malware Families

NagaPocker.apk: A mobile credential stealer likely targeting financial applications.
app-u7cp-release.apk: Appears to be a malicious application disguised as a legitimate tool.
ludashi_home.apk: Potentially masquerading as the legitimate Ludashi application to gain user trust.
k12sns.apk: Likely disguising itself as an educational social network application to target specific demographics.

Distribution Method

The malware is primarily distributed through:

QR codes with URL shorteners directing victims to malicious download sites
In-app deep links that bypass standard security checks
Direct malicious APK downloads outside official app stores
Potential social engineering campaigns targeting Ukrainian users

Payload Behavior

Credential harvesting from financial applications
Potential SMS interception for two-factor authentication bypass
Exfiltration of personal and financial data
Potential overlay attacks to mimic legitimate banking applications

C2 Communication

Communication with domains like snitch-dev.space, snitch-dev.site, snitch-dev.online, etc.
Likely using encrypted channels to exfiltrate stolen data
Domain infrastructure appears designed for evasion with multiple TLDs

Persistence Mechanism

Disguising as legitimate applications to remain installed
Potential use of background services that restart after device reboot
Abuse of Android accessibility services for persistent access

Anti-Analysis Techniques

Code obfuscation to evade static analysis
Potential environment detection to identify emulator/sandbox environments
Encryption of network communications to avoid traffic analysis

IOC Analysis

The indicators provided include domains and hostnames used in the attack infrastructure:

Domain Indicators:

xx.com
kzeva2010.sbs
snitch-dev.space
gui-snitch.online

Hostname Indicators:

gui.snitch-dev.site
gui.snitch-dev.online
gui.snitch-dev.xyz
gui.dev-snitch.xyz

SOC teams should operationalize these indicators by:

Blocking these domains and hostnames at network perimeter devices
Adding these indicators to SIEM correlation rules for network traffic
Implementing DNS sinkholing for these domains
Monitoring for any successful connections to these indicators
Checking firewall logs for any historical connections to these indicators

These domains appear to follow a pattern of using "-snitch-" or "snitch-dev" strings, suggesting a potential threat actor naming convention that could be used for threat hunting.

Detection Engineering

Sigma Rules

YAML

---
title: Potential Mobile Phishing via QR Code URL Shorteners
id: 2026-07-29-qr-phishing-1
status: experimental
description: Detects potential QR code phishing campaigns by identifying shortened URLs and suspicious domains
author: Security Arsenal
date: 2026/07/29
references:
    - https://unit42.paloaltonetworks.com/qr-codes-as-attack-vector/
tags:
    - attack.initial_access
    - attack.credential_access
    - attack.t1566.002  # Phishing: Spearphishing Link
logsource:
    category: proxy
    product: zeek
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains:
            - 'bit.ly'
            - 'tinyurl.com'
            - 'goo.gl'
            - 'snitch-dev'
            - 'kzeva2010.sbs'
            - 'gui-snitch.online'
            - 'snitch-dev.space'
    filter:
        c-uri|notcontains:
            - 'analytics'
            - 'tracking'
    condition: selection and not filter
falsepositives:
    - Legitimate use of URL shorteners
level: medium
---
title: Mobile Malware C2 Communication Detection
id: 2026-07-29-malware-c2-1
status: experimental
description: Detects potential command and control communication from mobile malware families
author: Security Arsenal
date: 2026/07/29
references:
    - https://unit42.paloaltonetworks.com/qr-codes-as-attack-vector/
tags:
    - attack.command_and_control
    - attack.c2
    - attack.t1071.001  # Application Layer Protocol: Web Protocols
logsource:
    category: proxy
    product: zeek
detection:
    selection:
        c-uri|contains:
            - 'snitch-dev'
            - 'kzeva2010.sbs'
            - 'gui-snitch'
    filter:
        resp-host|notcontains:
            - 'cdn'
            - 'update'
    condition: selection and not filter
falsepositives:
    - Rare legitimate traffic to similar domains
level: high
---
title: Mobile Malware APK Installation Detection
id: 2026-07-29-malware-install-1
status: experimental
description: Detects installation of known malicious APK files from QR code campaigns
author: Security Arsenal
date: 2026/07/29
references:
    - https://unit42.paloaltonetworks.com/qr-codes-as-attack-vector/
tags:
    - attack.execution
    - attack.initial_access
    - attack.t1204.002  # User Execution: Malicious File
logsource:
    product: android
    service: system
detection:
    selection:
        event_id: '7045'  # Service installation
        file_name|contains:
            - 'NagaPocker.apk'
            - 'app-u7cp-release.apk'
            - 'ludashi_home.apk'
            - 'k12sns.apk'
    condition: selection
falsepositives:
    - Legitimate installation of applications with similar names
level: critical

KQL for Microsoft Sentinel

KQL — Microsoft Sentinel / Defender

// Hunt for connections to suspicious domains from mobile devices
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("xx.com", "kzeva2010.sbs", "snitch-dev.space", "gui-snitch.online") 
    or RemoteUrl contains "snitch-dev" 
    or RemoteUrl contains "gui.snitch-dev" 
    or RemoteUrl contains "gui.dev-snitch"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc


kql
// Hunt for mobile devices with recent installations of suspicious APKs
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessCommandLine contains ".apk" and (
    ProcessCommandLine contains "NagaPocker" or
    ProcessCommandLine contains "app-u7cp-release" or
    ProcessCommandLine contains "ludashi_home" or
    ProcessCommandLine contains "k12sns"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

PowerShell Hunt Script

PowerShell

# PowerShell script to hunt for mobile malware artifacts on enterprise devices
# This script checks for indicators associated with QR code phishing campaigns

# Function to check for cached DNS entries of malicious domains
function Check-DNSCache {
    Write-Host "Checking DNS cache for malicious domains..." -ForegroundColor Yellow
    
    $maliciousDomains = @("xx.com", "kzeva2010.sbs", "snitch-dev.space", "gui-snitch.online",
                          "gui.snitch-dev.site", "gui.snitch-dev.online", "gui.snitch-dev.xyz",
                          "gui.dev-snitch.xyz")
    
    $dnsCache = Get-DnsClientCache | Where-Object { $maliciousDomains -contains $_.Entry }
    
    if ($dnsCache) {
        Write-Host "Found suspicious DNS cache entries:" -ForegroundColor Red
        $dnsCache | Format-Table Entry, Data, Status -AutoSize
    } else {
        Write-Host "No suspicious DNS cache entries found." -ForegroundColor Green
    }
}

# Function to check for browser history entries with malicious domains
function Check-BrowserHistory {
    Write-Host "Checking browser history for malicious domains..." -ForegroundColor Yellow
    
    $maliciousDomains = @("xx.com", "kzeva2010.sbs", "snitch-dev.space", "gui-snitch.online",
                          "gui.snitch-dev.site", "gui.snitch-dev.online", "gui.snitch-dev.xyz",
                          "gui.dev-snitch.xyz")
    
    # This is a simplified check - in practice, you would need to parse specific browser history files
    $historyPaths = @(
        "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
        "$env:LOCALAPPDATA\Mozilla\Firefox\Profiles\*.default*\places.sqlite",
        "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
    )
    
    foreach ($path in $historyPaths) {
        if (Test-Path $path) {
            Write-Host "Found browser history file: $path" -ForegroundColor Cyan
            # In a real implementation, you would parse the SQLite database
        }
    }
    
    Write-Host "Manual review of browser history recommended for:", ($maliciousDomains -join ", ") -ForegroundColor Yellow
}

# Function to check for installed mobile device management agents that might connect to malicious domains
function Check-MobileDeviceConnections {
    Write-Host "Checking for mobile device management connections..." -ForegroundColor Yellow
    
    $processes = Get-Process | Where-Object { $_.ProcessName -like "*android*" -or $_.ProcessName -like "*adb*" -or $_.ProcessName -like "*mobile*" }
    
    if ($processes) {
        Write-Host "Found potential mobile device management processes:" -ForegroundColor Cyan
        $processes | Select-Object ProcessName, Id, Path | Format-Table -AutoSize
        
        Write-Host "Checking network connections for these processes..." -ForegroundColor Yellow
        
        $connections = Get-NetTCPConnection | Where-Object { 
            $processes.OwningProcess -contains $_.OwningProcess 
        } | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
        
        if ($connections) {
            Write-Host "Found network connections from mobile management processes:" -ForegroundColor Cyan
            $connections | Format-Table -AutoSize
        }
    } else {
        Write-Host "No mobile device management processes found." -ForegroundColor Green
    }
}

# Main script execution
Check-DNSCache
Check-BrowserHistory
Check-MobileDeviceConnections

Write-Host "Hunt completed. Review findings for potential QR code phishing infections." -ForegroundColor Yellow

Response Priorities

Immediate:

Block all identified domains and hostnames at network perimeter devices
Implement DNS sinkholing for malicious domains to detect potential infection attempts
Deploy network signatures to detect traffic to these indicators
Issue security awareness alert about QR code phishing to all employees
Begin hunting for any systems that may have communicated with these domains

24h:

Conduct identity verification for users in the financial, technology, and retail sectors
Review mobile device management logs for connections to suspicious domains
Implement additional monitoring for QR code usage in the corporate environment
Scan mobile devices with mobile security tools to detect installed malicious APKs
Update endpoint detection rules to include behavioral detection for these malware families

1 week:

Implement QR code scanning policy and controls on corporate mobile devices
Enhance mobile application security by:
- Restricting installation of apps outside official stores
- Implementing application allowlisting for corporate devices
- Deploying mobile threat defense solutions
Update security awareness training to include QR code phishing scenarios
Review and update mobile device management policies based on attack vectors
Implement network segmentation to limit potential lateral movement from compromised mobile devices

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub