Once granted this permission, the spyware app uses this overlay access to forcibly display a password prompt whenever the user tries to uninstall or deactivate the app through Android’s settings.

A new Android spyware named 'KoSpy' is linked to North Korean threat actors who have infiltrated Google Play and third-party app store APKPure through at least five malicious apps.

The spyware is not available on Google Play or third-party app stores, suggesting that it is distributed manually.