Back Nknews

North Korean cybercriminals use AI coding agent to enhance phishing attacks

Nknews • September 7, 2026

New evidence of an AI agent producing decoy files shows how technology can accelerate automated attack preparation

Shreyas Reddy September 7, 2026

North Korean cybercriminals are using an artificial intelligence (AI) coding agent to mass-produce decoy documents for a malware campaign, providing new evidence that the country’s threat groups are incorporating self-directed AI into attack preparation and operations, according to a South Korean cybersecurity firm.

In a recent phishing campaign, the Pyongyang-backed cybercriminal group Kimsuky was observed using “opencode,” an AI coding agent capable of generating decoy documents files from natural-language instructions, Genians said in a report published Monday.

Genians found the name of the AI tool in the metadata of some PDF files, offering unusually

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Hacking Group Uses AI Coding Agent for Malware Decoys The North Korea-linked hacking group Kimsuky has been confirmed to use an open-source AI coding agent named 'opencode' to create decoy documents for malware distribution. A South Korean security firm, Genians, reported that analysis of 13 malicious files revealed that these documents were disguised as financial and insurance-related materials to lure users into activating malware. The metadata of the decoy files indicated they were generated by the AI agent, with both 'creator' and 'producer' fields showing 'opencode.' This marks the first confirmed use of an AI coding agent by Kimsuky, which had previously been known to utilize large language models for similar purposes. The attack method involved sending emails with compressed files containing these decoy documents, which, when clicked, activated the malware. The findings highlight a significant evolution in Kimsuky's tactics, indicating a shift towards automated attack preparation using AI technology. 6 sources 73

Extracted Entities

North Korean cybercriminals use AI coding agent to enhance phishing attacks

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

MITRE ATT&CK (1)

Tools (1)