Kimsuky Uses AI

Cybersecuritynews •Tushar Subhra Dutta • August 24, 2026

Kimsuky has been linked to a new espionage campaign that turns a Chrome extension into a quiet Gmail collector. The operation begins with convincing phishing emails and ends with attackers gaining access to messages, attachments, and a victim’s computer. Its mix of browser theft and remote control makes a single opened file especially risky. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Exploits Remote Access Tools and AI in Espionage Campaign Kimsuky threat actors are conducting spear-phishing campaigns targeting South Korea and Japan, utilizing OneDrive-hosted LNK files to deliver malware. The malware establishes persistence through scheduled tasks and retrieves PowerShell scripts to exfiltrate sensitive data, including emails and keystrokes. Attackers employ legitimate remote control tools like Chrome Remote Desktop and AnyDesk to maintain access, blending in with normal administrative activities. A malicious Chrome extension has been identified that collects Gmail data, indicating the use of generative AI in its development. Security experts recommend caution with LNK files from unknown sources and regular audits of installed software for unauthorized remote access tools. Organizations are advised to monitor for suspicious scheduled tasks and unexpected processes related to AnyDesk. The threat remains active and poses significant risks to targeted organizations. 2 sources 72

Extracted Entities

Kimsuky Uses AI

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)