Back Gbhackers

Konni Hijacks KakaoTalk Accounts in Spear

Gbhackers •Mayura Kathir • March 16, 2026

Konni APT recently ran a multi-stage malware operation that hijacked KakaoTalk accounts to spread remote access trojans (RATs) through highly targeted spear‑phishing. The message used contextual content aligned with the victim’s role to build trust and trick them into opening an attached archive. That archive contained a malicious LNK shortcut masquerading as a document; once […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Konni Group Uses KakaoTalk for Malware Distribution in Spear-Phishing Campaign North Korea-linked hackers from the Konni group executed a spear-phishing campaign utilizing the KakaoTalk messaging platform to distribute malware and steal sensitive information. The campaign involved sending emails that falsely offered appointments as lecturers on North Korean human rights issues, containing malicious shortcut files that installed remote-access malware. Once inside the victims' systems, the attackers hijacked their KakaoTalk accounts to further propagate the malware to contacts within the victim's friend list. This multi-stage operation combines trust-based propagation and long-term persistence, allowing the attackers to maintain access and gather sensitive data. The campaign is part of a broader trend of North Korean cyber operations aimed at funding the regime's nuclear and ballistic missile programs. The South Korean cybersecurity firm Genians Security Center conducted the analysis and reported the findings on March 16, 2026. 9 sources 73

Extracted Entities

Konni Hijacks KakaoTalk Accounts in Spear

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

MITRE ATT&CK (2)

Tools (1)