North Korean Hackers Use AI to Sharpen Crypto Phishing Attacks

The mechanics of the phishing chain itself remain familiar. Genians observed malicious ZIP archives containing LNK shortcut files that, when opened, launch an embedded PowerShell loader. Researchers also linked GitHub and GitLab repositories to the operation, using Git-based infrastructure for command-and-control and to distribute encrypted AsyncRAT payloads.

What changes with local AI is how efficiently parts of that process can be improved. Local models could help attackers analyze stolen documents in place, tailor phishing emails to specific targets, assist with writing malware and automate repetitive tasks without ever touching a public chatbot, Genians said. The firm assessed that the group is accumulating the tools and expertise needed to integrate AI more widely into future operations.

For crypto companies, the research points in a specific direction. Obvious spelling mistakes and poorly formatted documents are becoming less useful as red flags. Defenses now depend more on sender verification, suspicious file behavior and endpoint activity monitoring than on whether a phishing message looks obviously fake.

Genians stressed that it found evidence of Kimsuky integrating existing AI technologies, not training proprietary models. The firm assesses the group is accumulating the tools and expertise needed to incorporate AI more widely into future operations.