Kimsuky Uses OpenCode AI Agent and GitHub PATs in Operation GitPower Attacks

Gbhackers •Mayura Kathir • September 7, 2026

North Korea-linked threat actor Kimsuky has expanded its Operation GitPower activity with malicious LNK shortcuts, GitHub Personal Access Token (PAT)-authenticated payload delivery, and AI-generated decoy documents linked to the OpenCode coding agent. Genians Security Center analyzed 13 malicious LNK samples collected between August 11 and August 19, 2026. The files were delivered in ZIP archives […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Hacking Group Uses AI Coding Agent for Malware Decoys The North Korea-linked hacking group Kimsuky has been confirmed to use an open-source AI coding agent named 'opencode' to create decoy documents for malware distribution. A South Korean security firm, Genians, reported that analysis of 13 malicious files revealed that these documents were disguised as financial and insurance-related materials to lure users into activating malware. The metadata of the decoy files indicated they were generated by the AI agent, with both 'creator' and 'producer' fields showing 'opencode.' This marks the first confirmed use of an AI coding agent by Kimsuky, which had previously been known to utilize large language models for similar purposes. The attack method involved sending emails with compressed files containing these decoy documents, which, when clicked, activated the malware. The findings highlight a significant evolution in Kimsuky's tactics, indicating a shift towards automated attack preparation using AI technology. 6 sources 73

Extracted Entities

Kimsuky Uses OpenCode AI Agent and GitHub PATs in Operation GitPower Attacks

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Countries (1)

Platforms (1)

Tools (1)