An AI Shortcut to Scale Phishing

Security researchers at Genians say the North Korea-linked Kimsuky group has added a new tool to its phishing playbook: an AI coding agent called OpenCode. Rather than hand-crafting each decoy document, the group appears to be using the agent to churn out convincing financial and corporate-themed lures in bulk, then wrapping them inside malicious Windows shortcut (LNK) files for delivery.

The findings, tied to a Kimsuky-affiliated activity cluster researchers call Operation GitPower, mark a continuation of the group’s earlier experiments with local language models for crafting lure content — this time with a workflow that looks less like manual document creation and more like an automated production line.

Malicious Shortcuts Disguised as Documents

The campaign begins with spear-phishing emails carrying ZIP archives. Inside sits an LNK file dressed up with a browser-style icon and falsified metadata to look like an ordinary document. Opening it shows the victim a decoy file while, behind the scenes, PowerShell quietly launches to fetch further payloads.

Genians examined 13 samples collected between August 11 and 19, 2026, all using financial and corporate pretexts — the kind of payment notices and billing documents that busy office staff tend to open without a second thought.

Fingerprints of an Automated Pipeline

Several details point to machine-driven, rather than manual, document creation:

• Multiple decoy PDFs carried “opencode” in their Creator and Producer metadata fields.
• Four documents shared an identical creation timestamp of August 16, with the Author field generically set to “anonymous.”
• Some drafts still contained unreplaced placeholder text where payment dates, grace periods, or dollar figures should have been filled in — a sign of speed over polish.
• Other files carried HeadlessChrome and Skia/PDF metadata, suggesting the lures were first rendered as HTML and then converted to PDF programmatically.

Of 29 recovered decoy files, researchers found only 11 were actually unique by MD5 hash — the rest were the same content redistributed under randomized filenames, reinforcing the picture of automated, high-volume production rather than bespoke targeting.

GitHub and Pastebin as Command Infrastructure

Every LNK sample analyzed launched PowerShell using encrypted loader code hidden inside command-line arguments stretching from roughly 5,800 to 9,500 characters. Around 300 leading spaces pushed the actual commands out of view in the shortcut’s properties window, while extra padding bloated file sizes to frustrate both manual review and automated scanning.

The loader retrieves decoy content and follow-on scripts from GitHub’s raw content service using hardcoded personal access tokens, then drops randomly named PowerShell files into AppData or Temp folders. It launches PowerShell through conhost.exe --headless and registers hidden scheduled tasks disguised as BitLocker, MATLAB, or .NET components to maintain persistence. One Visa-themed variant added Pastebin as a fallback source, giving the operators a second channel if GitHub access is blocked.

Built With Analysts in Mind

Newer samples actively check for virtual machines and analysis tooling, search the system for the username “Bruno” — a possible researcher signature the group has flagged before — and wipe PowerShell command history when a research environment seems likely. Even builds that fail partway through, showing only an error document to the victim, can still complete persistence and payload-retrieval steps in the background.

Why It Matters

The use of GitHub and Pastebin, both trusted developer platforms, lets malicious traffic hide inside ordinary web activity that many security tools wave through. Combined with AI-assisted content generation, that gives Kimsuky a way to widen its net — hitting more corporate inboxes with more varied, plausible-looking bait — without a proportional increase in manual effort.

Recommendations for Defenders

• Treat unsolicited ZIP archives containing LNK files as high-risk, particularly when icons or file descriptions don’t match the archive’s stated contents.
• Correlate LNK executions with unusually long command lines, hidden PowerShell processes, newly created scripts, and scheduled-task registration.
• Flag outbound requests to GitHub’s raw content endpoints carrying unfamiliar access tokens, along with any Pastebin traffic from endpoint systems.
• Move toward behavior-based detection rather than relying on domain blocklists or a document’s surface-level polish — AI-assisted lures are, by design, harder to spot on sight.