North Korean Hackers Deploy AI to Automate Spear-Phishing Attacks

North Korean hackers adopt AI for social engineering

North Korea's state-backed hacking operations have begun leveraging artificial intelligence to scale and automate cyberattacks, according to a new report from South Korean cybersecurity firm Genians. The intelligence-linked group Kimsuky has incorporated AI-generated documents into spear-phishing campaigns targeting military, diplomatic, and academic institutions since 2026.

The attacks disguise malicious files as legitimate materials—research reports, invitations, and other professional documents—that are crafted using AI automation. To evade detection, Kimsuky has turned to open-source tools including Ollama, GPT-4All, and Msty, which enable the operation of large language models without internet connectivity, Genians reported Monday.

Why it matters

This development marks a tactical evolution in state-sponsored cyber operations. By using AI to automate social engineering at scale, threat actors can produce convincing attack materials faster and in greater volume than traditional methods allowed. The shift lowers technical barriers for malicious campaigns and signals that AI-enabled cyberattacks will become increasingly common across all threat actor categories, not just nation-states.

Offline AI tools enable stealthy operations

The use of offline language models represents a deliberate operational security choice. Running AI tools locally, without internet connections, helps attackers avoid leaving digital traces that security researchers might detect. Genians emphasized that AI enables "highly polished documents on a wide range of topics within a short period of time," making it particularly effective for threat actors.

The cybersecurity firm noted this change "demonstrates that AI can enable the automation and large-scale production of social engineering attacks," moving beyond simply changing how decoy documents are created.

Broader context of North Korean cyber operations

Kimsuky and other North Korean state-linked groups have conducted numerous cyberattacks in recent years, many focused on financial gain. British blockchain analytics firm Elliptic reported that North Korean hackers stole more than $2 billion in cryptocurrency during the first nine months of 2025 alone.

Historically, North Korea was identified by U.S. authorities as responsible for the 2014 Sony Pictures hack, which followed the studio's release of "The Interview," a comedy film that lampooned North Korean leader Kim Jong Un.

Expert perspectives on AI-enabled threats

Jenny Town, a senior fellow at the Stimson Center in Washington, DC, said the development was unsurprising given North Korea's cyber capabilities. "North Korea's hackers and programmers are more than capable of utilising and exploiting various AI tools to enhance their efforts," she said. "This is a new reality of all threat actors; North Korea is no exception."

Mark T. Hofmann, a criminal and intelligence analyst specializing in cybercrime, described AI as causing a seismic shift in cybercrime by lowering entry barriers. "You no longer need hacking skills or a master's degree in computer science. All you need is a computer and a motive," Hofmann said. He warned that "AI-supported cyberattacks will become a regular phenomenon" and represent "one of the main challenges of this decade."

The findings were first reported by Al Jazeera, based on the Genians report released Monday.