Pyongyang-linked cyber spies embrace AI tools in phishing campaigns, security researchers warn

South Korean cybersecurity experts have uncovered eviden…

South Korean cybersecurity experts have uncovered evidence that a hacking collective tied to North Korea is now incorporating artificial intelligence into its digital espionage playbook.

The group, known as Kimsuky, has expanded its use of AI to craft more convincing spear-phishing emails, according to a new analysis from a Seoul-based security firm. These messages are designed to trick diplomats, academics, and government officials into clicking malicious links or opening infected attachments.

Researchers say the shift marks a significant evolution in the group's tactics. Where older campaigns relied on manually written lures, the latest operations show signs of AI-generated text that closely mimics legitimate correspondence, making detection far more difficult for recipients and automated filters alike.

The findings underscore a broader trend in which

The findings underscore a broader trend in which state-sponsored hackers are leveraging commercially available AI models to enhance the scale and sophistication of their attacks. Kimsuky, which has been active for over a decade, is believed to operate under the guidance of North Korea's intelligence services.

While the firm did not disclose specific targets, past operations by the group have centered on stealing nuclear policy documents, satellite technology blueprints, and other sensitive research. The new report urges organizations in related fields to bolster their email security protocols and train staff to recognize subtle anomalies in unsolicited messages.

Security analysts caution that AI-generated phishing content can evade traditional keyword-based defenses, but human vigilance remains a critical barrier. They recommend verifying the authenticity of any unexpected request, even when the sender's name and tone appear familiar.