North Korean hacking group Kimsuky deploys AI-generated phishing documents, report says

According to a report from Genians, the North Korean state-linked hacking outfit Kimsuky has incorporated artificial-intelligence generators into its spear-phishing operations beginning in 2026. By running open-source language models like Ollama, GPT-4All and Msty on isolated systems, the group can swiftly produce polished documents that masquerade as legitimate research papers or event invitations. These AI-driven decoys are then dispatched to targets in the military, diplomatic and academic sectors, automating a process that previously required considerable expertise.

The firm warns that this shift marks a new phase where AI not only aids in crafting deceptive content but also enables large-scale attacks with minimal technical skill. Historical context includes Kimsuky’s involvement in numerous financially motivated breaches, including the theft of over $2 billion in cryptocurrency in early 2025. Analysts such as Jenny Town and Mark T. Hofmann say the move reflects a broader, worrying trend of AI-enhanced cybercrime worldwide.