Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.
The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.
The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.
Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster.
Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.
Kimsuky Hackers Use OpenCode AI Agent
The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.
Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.
The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.
Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.
That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.
Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.
Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.
LNK Loaders Hide GitHub-Based Payloads
Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.
About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.
After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.
It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.
One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.
Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.
They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.
Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.
Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.
This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| MD5 | 10780939962b54addc9d31f57d80edfc |
Malicious sample hash |
| MD5 | 1523a2fcc901965ab4568d9fe829e4af |
Malicious sample hash |
| MD5 | 500e0bc0d7579fb338912770964076fe |
Malicious sample hash |
| MD5 | 685bfc6b2c29fbc16cfad908894add55 |
Malicious sample hash |
| MD5 | 7a53089053b1381742856a5cf2b95f8b |
Malicious sample hash |
| MD5 | 8db2f20b719dcb7029d6296505622093 |
Malicious sample hash |
| MD5 | 900e832c10d851bbdef3fb191a15db0e |
Malicious sample hash |
| MD5 | a2015665a3e18bf0ef86e3931245c7e6 |
Malicious sample hash |
| MD5 | bb88940e915b11f6330b7446f6037f5b |
Malicious sample hash |
| MD5 | ce5932b88f879f26006df81f2fa7667e |
Malicious sample hash |
| MD5 | d0894d4626aae0f96d6b84ca3bb71a36 |
Malicious sample hash |
| MD5 | e50f2ae7fb03675a1ef58b1cf9cda6d1 |
Malicious sample hash |
| MD5 | f648bdd3c2cd902e239149de86d43e8f |
Malicious sample hash |
| GitHub account | github[.]com/sven5500 |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/montry111 |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/jamjack2026 |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/urusa4400 |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/jamestony88 |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/baras6600P |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/choemiyang |
GitHub account linked to campaign infrastructure |
| GitHub account | github[.]com/jeni534 |
GitHub account linked to campaign infrastructure |
| URL | pastebin[.]com/raw/gybpx38s |
Pastebin-based second-stage payload delivery URL |
baras6600@proton[.]me |
Campaign-associated email address | |
choemiyang@hotmail[.]com |
Campaign-associated email address | |
dustinharrise91@outlook[.]com |
Campaign-associated email address | |
jackal3300@proton[.]me |
Campaign-associated email address | |
jametony8@outlook[.]com |
Campaign-associated email address | |
jamjack2026@proton[.]me |
Campaign-associated email address | |
montry111@proton[.]me |
Campaign-associated email address | |
sven5500@proton[.]me |
Campaign-associated email address | |
taini7700@outlook[.]com |
Campaign-associated email address | |
urusa4400@proton[.]m |
Campaign-associated email address, recorded exactly as listed in the source |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.