North Korea Hackers Use AI in Spear-Phishing Attacks

South Korean cybersecurity firm AhnLab reported that the North Korean‑linked hacking group known as Kimsuky has begun incorporating AI‑generated documents into its spear‑phishing campaigns. The firm’s analysis, released on Thursday, indicates that the malicious actors are using large‑language‑model tools to create convincing PDFs, spreadsheets and other files that appear to originate from legitimate corporate or governmental sources, thereby increasing the likelihood that targeted recipients will open the attachments and disclose credentials.

AhnLab’s threat intelligence team observed the new technique in several recent incidents targeting organizations in South Korea’s defense, energy and technology sectors. The AI‑crafted documents were paired with carefully crafted email lures that referenced recent news events, making the messages appear timely and authentic. While no large‑scale data breaches have been confirmed, the firm warned that the use of generative AI could amplify the effectiveness of Kimsuky’s operations and urged entities to reinforce email security controls, verify document origins and employ advanced detection solutions to mitigate the evolving threat.