Kimsuky Hackers Leverage AI to Automate Phishing LNK Attacks

Key Takeaways

• The Kimsuky APT group is leveraging AI to automate the creation of sophisticated phishing lures.
• The attacks utilize malicious LNK shortcut files disguised as legitimate documents within ZIP archives.
• These LNK files execute hidden PowerShell commands to download further payloads from GitHub and Pastebin.
• The campaign, identified as a continuation of Operation GitPower, targets financial and corporate entities with tailored decoys.
• Defenders should prioritize behavioral analysis over static indicators due to evolving evasion techniques.

The notorious Kimsuky advanced persistent threat (APT) group has escalated its phishing capabilities by integrating an AI agent to generate highly convincing decoys at scale. This new approach enables the group to embed malware within seemingly innocuous Windows shortcut files, transforming ordinary-looking documents into the initial vector for system compromise.

The attack chain typically commences with spear-phishing emails containing ZIP archives. Inside these archives, recipients find a malicious LNK shortcut file, artfully disguised as a document. These LNK files often feature icons mimicking web browsers or common document types, complete with fabricated details designed to entice a click. Upon execution, the LNK displays a benign decoy document to the user while covertly launching a PowerShell script in the background, which then fetches additional malicious code.

Security researchers analyzed 13 samples collected between August 11 and 19, 2026. These samples predominantly employed financial and corporate themes as lures, indicating a targeted effort against organizations and their personnel who regularly handle such sensitive information. The broad range of decoy topics significantly elevates the risk for corporate employees accustomed to receiving various business and financial documents.

Researchers at Genians have attributed this activity to the Kimsuky-linked cluster known as Operation GitPower. Genians said in a report shared with Cyber Security News (CSN) that this iteration of the campaign maintains its GitHub-based command and control (C2) infrastructure while introducing enhanced evasion techniques and a wider variety of decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

A significant development in this campaign is the discovery of “opencode” references within the Creator and Producer metadata of several PDF lures. This detail strongly suggests the use of an AI agent for automated content generation.

Four distinct documents, for instance, shared an identical creation timestamp of August 16, yet their “Author” field remained generic, listed as “anonymous.” This consistency points towards automated production rather than individual, manual creation. While the AI-generated documents were not uniformly polished—some contained unreplaced placeholder text for elements like payment dates and financial values, indicating a potential rush to deploy drafts—others displayed “HeadlessChrome” and “Skia/PDF” metadata. This suggests a secondary, more refined workflow that converts HTML content into cleaner PDF formats, allowing for both rapid deployment and higher quality lures depending on the target.

This dual approach provides the attackers with both speed and versatility without sacrificing the effectiveness of their social engineering tactics. Analysts observed 29 retrieved decoy files, but only 11 unique documents when assessed by MD5 hash. This indicates that the same content is being repeatedly distributed under different, randomized filenames, further evidence of automated processes. This strategy builds upon previous observations where Kimsuky had already utilized AI-generated content to make shortcut-based attacks appear routine.

It is crucial for defenders to understand that such metadata anomalies or minor imperfections in document quality may disappear as the threat actors further refine their automated processes. Therefore, relying solely on these indicators to deem an attachment safe is an unreliable security measure.

LNK Loaders Hide GitHub-Based Payloads

Each analyzed LNK file was designed to launch PowerShell, embedding an encrypted loader within its arguments. These command strings were notably lengthy, ranging from approximately 5,800 to 9,500 characters. To further obscure detection, about 300 leading spaces were added to keep the command out of immediate view in the shortcut properties window. This, along with excessive padding, intentionally inflated file sizes to complicate simple inspection and bypass some automated security checks.

Once the hidden content is decoded, the loader proceeds to download a decoy document and a subsequent script from GitHub Raw Content, leveraging a hardcoded personal access token. The malicious process then creates randomly named PowerShell files in either the AppData or Temp directories, initiates PowerShell via conhost.exe --headless, and establishes hidden scheduled tasks. These tasks are crafted to impersonate legitimate system components such as BitLocker, MATLAB, or .NET to maintain persistence and evade detection.

In one observed variant themed around Visa, the threat actors also incorporated a fallback mechanism, pulling code from Pastebin. This provides an alternative delivery route for payloads should access to GitHub be blocked. This strategy aligns with previous North Korean GitHub C2 attacks, where trusted developer platforms were exploited to blend malicious network traffic with legitimate web activity, making it harder to differentiate.

Newer iterations of the malware include checks for virtual machine and analysis tools, look for the specific username “Bruno,” and are designed to delete PowerShell command history when a likely research environment is detected. While some incomplete builds may display error documents, the critical persistence and payload retrieval stages of the attack can still successfully execute. These advanced LNK PowerShell loader techniques underscore why merely inspecting a file’s apparent type or icon is insufficient for determining its safety.

What You Should Do

• Quarantine Suspicious Attachments: Immediately isolate any unsolicited ZIP archives containing LNK files, particularly if their icons or descriptions do not accurately reflect their purported content.
• Implement Advanced Endpoint Detection: Deploy and configure Endpoint Detection and Response (EDR) solutions to monitor for anomalous behaviors, such as PowerShell execution with unusually long command lines, the creation of hidden PowerShell scripts, or new scheduled task registrations that mimic legitimate services.
• Monitor Network Traffic for C2 Activity: Scrutinize network traffic for connections to GitHub Raw Content or Pastebin, especially those involving unusual personal access tokens or unexpected data retrieval.
• Educate Users on Phishing Tactics: Conduct regular security awareness training to educate employees about the evolving nature of phishing attacks, emphasizing the dangers of opening unexpected attachments and verifying sender legitimacy.
• Adopt a Behavior-First Security Approach: Prioritize security solutions that focus on detecting malicious behaviors and attack chains rather than relying solely on static indicators like file hashes or domain blocklists, which can be easily circumvented by adaptive threat actors.
• Review and Enforce Email Security Policies: Implement robust email gateway security that can detect and block malicious attachments, including nested archives and LNK files, before they reach end-users.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.