North Korean Hackers Weaponizing AI to Supercharge Phishing, Malware and Cyberattacks

North Korean threat actors are rapidly expanding their use of generative and agentic AI to accelerate cyberattacks, using the technology to create convincing job scams, research targets, develop malware, build fake identities and scale phishing campaigns, according to Microsoft Threat Intelligence.

Microsoft says the overall adoption of AI across North Korean threat actors is now high, with some groups having embedded AI across their entire operational workflows.

North Korea Is Using AI to Scale Cyber Operations

Microsoft said AI is increasingly being used as a "force multiplier" rather than as a replacement for human operators. The technology is helping threat actors increase the speed, efficiency and complexity of established attack methods.

The scale-up is already visible. Jade Sleet launched campaigns through three front companies in a single week, while Onyx Sleet generated dozens of tailored lures within minutes.

Coral Sleet rapidly developed a capability to trojanize private source-code repositories, while Diamond Sleet used AI to improve targeting workflows, including persona development and front-company creation.

Onyx Sleet and Pearl Sleet have also used the open-source agentic AI penetration-testing framework ARTEX in operations.

Microsoft places North Korean groups across four AI adoption stages: operationalized, accelerating, expanding and emerging.

Jade Sleet, Coral Sleet and Jasper Sleet have operationalized AI across their operations, while Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are classified as accelerating.

Emerald Sleet remains in the expanding stage, and Microsoft has not currently classified any North Korean actor as emerging.

AI Is Making Fake Job Attacks Faster and More Convincing

One of the biggest areas of AI adoption is reconnaissance and social engineering. North Korean actors are using AI to research organizations and employees, study blockchain and cryptocurrency operations, explore vulnerabilities and cloud services, and investigate software-development roles to create highly tailored job applications and phishing campaigns.

Between June 8 and June 12, 2026, Microsoft Threat Intelligence identified Jade Sleet conducting job-themed targeting against individuals across various organizations, including those involved in cybersecurity, AI, blockchain, and talent recruitment companies.

Between June 8 and June 12, 2026, Microsoft Threat Intelligence identified Jade Sleet conducting job-themed targeting against individuals across various organizations, including those involved in cybersecurity, AI, blockchain, and talent recruitment companies.

The group used tailored domains, social-media profiles and industry knowledge while posing as recruiters for a fake AI-powered blockchain intelligence company.

Jasper Sleet has similarly used generative and agentic AI-assisted resume workflows to create fake digital personas, helping it increase the speed and scale of employment-themed operations.

Diamond Sleet has also used AI while targeting oil and gas, communications, internet-policy and defense-related organizations, including creating fake communications technology companies to approach telecommunications firms under the guise of legitimate business partnerships.

Microsoft said AI is being used to produce tailored phishing and investment lures, create resumes and interview responses, translate communications, manage multiple worker personas and alter profile images, video, voice and backgrounds.

AI Is Also Speeding Up Malware Development

The threat extends beyond social engineering. Microsoft found evidence that groups including Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet are using AI-assisted development platforms such as Cursor to generate, debug and refactor code, create scripts and persistence mechanisms, troubleshoot errors and adapt malicious functionality across different programming environments.

Microsoft Threat Intelligence has identified over 100 PDF lure files attributed to Onyx Sleet that were created in August and September 2026 with target-specific details. Metadata indicated that the actor created dozens of files at a time in rapid succession within minutes, highly likely to be the output of an AI platform.

Microsoft Threat Intelligence has identified over 100 PDF lure files attributed to Onyx Sleet that were created in August and September 2026 with target-specific details. Metadata indicated that the actor created dozens of files at a time in rapid succession within minutes, highly likely to be the output of an AI platform.

Microsoft further said the automation could make high-volume phishing campaigns harder to disrupt because it can rapidly regenerate or modify additional lures.

Coral Sleet has also operationalized a workflow since April 2026 to trojanize private GitHub repositories, with Microsoft assessing that the capability was highly likely engineered using an AI-enabled development platform.

Sapphire Sleet, meanwhile, likely incorporated AI during an August 2026 Rust software compromise, where its malware showed improvements including dynamic .NET compilation for defense evasion.

Despite the growing sophistication, Microsoft stressed that these operations remain human-directed rather than fully autonomous.

AI is primarily increasing the productivity and scale of North Korea's existing cyber operations, potentially allowing attackers to move faster than defenders can identify and block their evolving tactics.