NK hacking group Kimsuky used AI coding agents to create decoys: report

South Korean security firm Genians Inc. reported that North Korea-linked hacking group Kimsuky used the open-source AI coding agent opencode to create decoy documents for malware distribution, marking the first such detection by the company. Analysis of 13 malicious files collected last month revealed that emails contained compressed files with titles like "insurance bills" or "policy fund notice," and PDF metadata listed "opencode" as both creator and producer, indicating AI-generated content.

North Korea-linked hacking group Kimsuky was found to have leveraged artificial intelligence AI coding agents to create decoys for malicious codes, a local security firm said Monday. Such findings were detected after an analysis of 13 malicious files collected last month, Genians Inc. said in its latest cybersecurity threat intelligence report. According to the report, researchers found that the hacking group distributed emails attached with compressed files holding documents with titles such as "insurance bills," or "policy fund notice". They activated malware when users click them, the report said. The files contained traces of being created by an open-sourced AI coding agent called opencode. "In some of the PDF documents, both the 'creator' and 'producer' fields in the metadata were listed as 'opencode,'" the report said. "These are not values typically generated with standard document creation software, strongly suggesting the documents were generated by an AI agent, through programming, rather than created manually." Genians said it marks the first time that the company has detected