Kimsuky Hackers Automate Phishing Decoy Production with AI Agent 'OpenCode'
The Kimsuky threat group is employing an AI agent named OpenCode to rapidly generate sophisticated phishing decoys, increasing the scale and speed of their attacks.
The notorious Kimsuky threat group has adopted an artificial intelligence agent, dubbed OpenCode, to automate the creation of convincing phishing decoys. This advancement allows the group to mass-produce malicious lures, significantly accelerating their spear-phishing campaigns and posing a heightened risk to corporate environments. The campaign, identified as a continuation of Operation GitPower, leverages GitHub for its command and control infrastructure while incorporating new evasion techniques and varied decoy formats.
The latest observed tactics involve spear-phishing emails containing ZIP archives. Upon extraction, these archives reveal malicious LNK (shortcut) files disguised as legitimate documents, often featuring convincing icons and false metadata. When a victim opens the LNK file, it displays a decoy document to mask the malicious activity while simultaneously launching PowerShell. This PowerShell script then proceeds to download and execute further payloads from remote servers.
Researchers analyzed 13 samples collected between August 11 and 19, 2026, noting the use of financial and corporate-themed lures. The automated nature of the decoy generation is evidenced by metadata within several PDF lures, which show 'OpenCode' as the creator and producer, and a consistent creation timestamp across multiple documents with the author field set to 'anonymous.' While some documents contained placeholder text, indicating a rapid, less refined production process, others utilized different workflows to render HTML content into cleaner PDFs, demonstrating a balance between speed and a polished appearance.
The LNK files are designed to conceal a heavily padded and encrypted PowerShell loader within their arguments, often exceeding 9,500 characters. This padding serves to obscure the malicious command from casual inspection and some automated analysis tools. Once decoded, the loader establishes communication with GitHub Raw Content, utilizing a hardcoded personal access token to download additional stages of the attack. It then creates randomly named PowerShell files in common locations like AppData or Temp.
To maintain persistence and evade detection, the malware registers hidden scheduled tasks that impersonate legitimate system components such as BitLocker, MATLAB, or .NET. In some variants, the attackers also incorporate Pastebin as a secondary delivery route, providing a fallback if their primary GitHub infrastructure is compromised. This multi-pronged approach builds upon previous North Korean cyber operations that have abused trusted developer platforms for command and control.
Further enhancing their evasion capabilities, newer variants of the malware include checks for virtual machines and analysis tools. The attackers also attempt to clear PowerShell command history upon detecting a likely research environment, aiming to erase traces of their activity. Despite some incomplete builds that might display error documents, the core persistence and payload retrieval mechanisms remain functional.
Security professionals are advised to treat unsolicited ZIP attachments containing LNK files with extreme caution, especially if their appearance or description does not match their actual file type. A behavior-first approach to detection is recommended, focusing on correlating LNK launches with long command lines, hidden PowerShell processes, newly created scripts, scheduled task registrations, unusual GitHub requests, and Pastebin access. This strategy is considered more robust than relying solely on domain blocklists or manual decoy document review.