Microsoft Report: North Korean Hackers Use AI to Generate Phishing Documents and Carry ...

ChainCatcher report, according to Yonhap News, Microsoft Threat Intelligence’s report released on the 29th reveals that North Korean hacker groups are leveraging artificial intelligence to accelerate cyberattacks against South Korean users, expanding from customized phishing documents, fake job postings, and identity impersonation to malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korea-linked hacker groups: three have reached the highest “Operationalized” stage at Level 4, integrating AI into their daily attack workflows; four are in the “Accelerating” stage, and one is in the “Expanding” stage. The report notes that during August–September this year, organized groups generated over 100 customized PDF bait documents targeting different victims, with instances of dozens being produced within minutes. Between June 8–12, attackers impersonated three fake companies to send fraudulent job offers to professionals in AI, blockchain, and cybersecurity. Additionally, Microsoft analysis suggests North Korean hackers may be using AI programming tools such as Cursor to assist with code generation, debugging, and evasion of detection. Since late October, the Reconnaissance General Bureau-affiliated groups “Onyx Sleet” (known in South Korea as Andariel) and “Pearl Sleet” have actively employed the open-source AI penetration testing framework ARTEX in real-world operations. Microsoft believes that while these groups have significantly improved their attack speed and efficiency through AI, they have not yet reached full autonomy in attacks, and recommends that organizations strengthen verification of job applicants, phishing defenses, and malicious code detection.