How did Kimsuky use AI coding agents in its latest cyberattacks?

Genians said the group used an open-sourced AI coding agent called opencode to help create decoy documents for malicious codes. The firm said some PDF metadata showed opencode in both creator and producer fields, which it said strongly suggested AI-generated documents.

What kind of phishing files did Kimsuky distribute in the attack campaign?

The group distributed emails attached with compressed files containing documents titled like insurance bills and policy fund notice. The files were designed to activate malware when users clicked them.

Why did Genians say this case was notable in its cybersecurity report?

Genians said it was the first time it had detected signs of Kimsuky using AI coding agents in malicious attacks. The company added that it had earlier found signs of the group using large language models to create decoys and plan attacks.

NK hacking group Kimsuky used AI coding agents to create decoys: report

Listen

Summary

North Korea-linked hacking group Kimsuky used AI coding agents to create decoys for malicious codes, Genians said Monday. The security firm said it found the signs after analyzing 13 malicious files collected last month. The group sent emails with compressed files carrying documents titled as insurance bills or policy fund notices that activated malware when clicked.

Key Facts

Genians said it analyzed 13 malicious files collected last month in its latest cybersecurity threat intelligence report.
The files were attached to emails and included compressed documents with titles such as insurance bills and policy fund notice.
PDF metadata in some files listed both the creator and producer fields as opencode.
Genians said this was the first time it had detected signs of Kimsuky using AI coding agents in malicious attacks, after previously seeing signs of LLM use to create decoys and plan attacks.

By Yonhap

Published Sep 7, 2026 11:25 am KST

North Korea-linked hacking group Kimsuky was found to have leveraged artificial intelligence (AI) coding agents to create decoys for malicious codes, a local security firm said Monday.

Such findings were detected after an analysis of 13 malicious files collected last month, Genians Inc. said in its latest cybersecurity threat intelligence report.

According to the report, researchers found that the hacking group distributed emails attached with compressed files holding documents with titles such as "insurance bills," or "policy fund notice". They activated malware when users click them, the report said.

The files contained traces of being created by an open-sourced AI coding agent called opencode.

"In some of the PDF documents, both the 'creator' and 'producer' fields in the metadata were listed as 'opencode,'" the report said.

"These are not values typically generated with standard document creation software, strongly suggesting the documents were generated by an AI agent, through programming, rather than created manually."

Genians said it marks the first time that the company has detected signs of Kimsuky utilizing AI coding agents in its malicious attacks.

Earlier, the company said it detected signs of the hacking group using large language models (LLM) to create decoys and plan malicious attacks.

Explore More