S2W reports that the Kimsuky APT group used a FastViewer variant merged with FastSpy and disguised as a legitimate mobile application. The analysis links the activity to prior FastViewer and FastSpy research from 2022 and says the newer variant appears to have been in production since at least 2023. The source assesses that distribution could follow earlier Kimsuky patterns, including spear-phishing emails or smishing that trick targets into executing the application. Defenders should validate Android application artifacts, C2 references, Google Sync abuse, and mobile telemetry before operational blocking.