AhnLab reported state-sponsored APT activity using phishing pages that imitate a well-known Korean portal site. The page changed behavior based on the visitor's user agent and offered either a PC security-program download or a mobile app lure to steal victim information. On Windows, the downloaded archive contained a dropper that displayed a fake installer dialog while creating additional malware in the temporary directory.