Lookout Threat Lab researchers discovered the spyware, dubbed KoSpy, attributing it with medium confidence to North Korean APT group ScarCruft, also known as APT37.
A federal judge temporarily blocked Khalil from being deported and will weigh the challenge to his arrest and detention in Louisiana.