Security researchers have uncovered fresh evidence that North Korean-linked Kimsuky hackers are using artificial intelligence to rapidly create phishing documents that look like routine business files.
The campaign, tracked as Operation GitPower, combines AI-made decoys with malicious Windows shortcut files, hidden PowerShell scripts, GitHub-hosted payloads, and scheduled tasks that maintain access to compromised machines.
Genians Security Center examined 13 malicious LNK files identified between August 11 and August 19, 2026.
The files were packaged in ZIP archives and disguised as notices about fund disbursements, insurance payments, interest, certificate renewals, customer records, retail operations, and Visa payments.
This wider set of lures suggests the attackers are seeking victims in financial institutions and corporate environments, in addition to the diplomatic, security, and academic targets commonly associated with Kimsuky.
North Korea AI Phishing Surge
The researchers collected 29 downloaded decoy files but found only 11 unique documents, showing that the group repeatedly reused material under randomized filenames. Several PDFs listed “opencode,” an AI coding agent, as both creator and producer.
Their author field was “anonymous,” while some pages still included text such as “(temporary value),” a sign that drafts were likely generated and distributed without careful human review.
Other PDFs carried HeadlessChrome and Skia/PDF metadata. Their similar language, standard layouts, and tightly grouped creation times indicate an automated workflow, content may have been produced from a common AI prompt or template, converted from HTML to PDF, and reused across different phishing themes.
Two Excel decoys also contained the AzureUser account name in their metadata. AI did not remove all mistakes. Some samples opened a PDF containing only the word “error,” while one Korean filename misspelled “renewal.”
Still, automation allows the operators to produce more varied lures quickly and tailor business language to a target.
The apparent documents were actually LNK shortcuts. They used Chrome icons and false file-property descriptions to appear harmless.
Their commands were unusually long and hidden behind roughly 300 leading spaces. When a victim executed a shortcut, it decoded and launched PowerShell code that downloaded a decoy file, displayed it, and silently installed additional malware.
The scripts retrieved content from GitHub Raw using hardcoded personal access tokens. One variant also used Pastebin as a backup payload-delivery channel, reducing the impact of a single infrastructure takedown.
The malware then created hidden scheduled tasks with names resembling BitLocker, MATLAB, or .NET components.
Those tasks repeatedly ran follow-on scripts, while some variants checked for virtual machines and analysis tools, deleted PowerShell command-history records, and removed themselves, Genians said.
Indicators of Compromise
| IOC Type | Indicators |
|---|---|
| MD5 hashes | 10780939962b54addc9d31f57d80edfc1523a2fcc901965ab4568d9fe829e4af500e0bc0d7579fb338912770964076fe685bfc6b2c29fbc16cfad908894add557a53089053b1381742856a5cf2b95f8b8db2f20b719dcb7029d6296505622093900e832c10d851bbdef3fb191a15db0ea2015665a3e18bf0ef86e3931245c7e6bb88940e915b11f6330b7446f6037f5bce5932b88f879f26006df81f2fa7667ed0894d4626aae0f96d6b84ca3bb71a36e50f2ae7fb03675a1ef58b1cf9cda6d1f648bdd3c2cd902e239149de86d43e8f |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
