Microsoft: North Korean Hackers Use AI to Scale Phishing, Fake Hiring and Malware Development

A Microsoft threat intelligence report released on the 29th says North Korean hacking groups are using AI to accelerate cyberattacks against South Korean users, including tailored phishing, fake recruitment and malicious code development. According to ChainCatcher, Microsoft assessed AI adoption across eight North Korea-linked groups: three reached the highest of four stages, described as “operationalized,” and have integrated AI into routine attack workflows; four were at the “accelerating” stage and one at the “expanding” stage. The report said hackers generated more than 100 tailored PDF decoy documents for different targets in August and September this year, with some producing dozens within minutes. From June 8 to 12 this year, attackers used three fake companies to send recruitment invitations to professionals in AI, blockchain and cybersecurity. Microsoft also said North Korean hackers may use AI coding tools such as Cursor to generate and debug code and evade detection. Onyx Sleet, known in South Korea as Andariel, and Pearl Sleet—both linked to the Reconnaissance General Bureau—have used the open-source AI penetration-testing framework ARTEX in operations since late October. Microsoft said the groups have increased the speed and efficiency of their attacks with AI but have not reached fully autonomous operations. It recommended that companies strengthen job applicant identity checks, phishing defenses and malicious-code detection.