Microsoft: North Korean Hackers Use AI to Mass-Generate Phishing Documents, With Fake Recruitment and Malicious Code Development Already Implemented

According to Yonhap News Agency, a report released by Microsoft Threat Intelligence on the 29th reveals that North Korean hacker groups are leveraging artificial intelligence (AI) to accelerate cyberattacks targeting South Korean users, expanding their tactics beyond customized phishing documents, fake job postings, and identity spoofing to include malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korea-related hacker groups: three have reached the highest "operationalized" stage, integrating AI into their daily attack workflows; four are in the "acceleration" phase, and one is in the "expansion" phase. The report notes that some groups generated over 100 targeted PDF lure documents for different targets between August and September this year, with cases of producing dozens of documents in just minutes. Between June 8 and 12, fake job offers were sent to AI, blockchain, and cybersecurity professionals using three spoofed companies. Additionally, Microsoft analysts found that North Korean hackers may be using AI programming tools like Cursor to assist with code generation, debugging, and evading detection. North Korea's Reconnaissance General Bureau-affiliated groups "Onyx Sleet" (referred to as Andariel by South Korea) and "Pearl Sleet" have been using the open-source AI penetration testing framework ARTEX in real-world operations since late October. Microsoft concluded that while these groups have boosted attack speed and efficiency through AI, they have not yet achieved fully autonomous attacks, and recommended that enterprises strengthen identity verification for job applicants, phishing protection, and malicious code detection.