Kimsuky Uses AI-Generated Chrome Extension to Automatically Steal Gmail Data

Kimsuky has been linked to a new espionage campaign that turns a Chrome extension into a quiet Gmail collector.

The operation begins with convincing phishing emails and ends with attackers gaining access to messages, attachments, and a victim’s computer. Its mix of browser theft and remote control makes a single opened file especially risky.

The campaign targeted people in South Korea and Japan during the first half of 2026. Victims received a OneDrive sharing link leading to an archive containing a Windows shortcut file, or LNK.

Opening the shortcut displayed a decoy document while a hidden command downloaded more malware and established a foothold. Analysts at Enki identified the activity and linked it to Kimsuky through its tools, targeting, and operating patterns.

Enki said in a report shared with Cyber Security News (CSN) that the group rotated command servers quickly and also abused compromised Korean servers, making the campaign harder to trace.

The case shows why email compromise can start far beyond the inbox. The attackers collected local Thunderbird and Outlook mail, logged keystrokes, and installed legitimate remote-access software.

Earlier Kimsuky Chrome extension campaign reporting illustrates how browser add-ons have remained a useful channel for the group’s surveillance operations.

Kimsuky Uses AI-Generated Chrome Extension

The malicious extension, named “Gmail automatic server uploader” in Korean, was built to monitor Gmail pages. Its content script watched both the message-reading panel and the Send button.

When a user read or sent a message, it collected the sender or recipient, subject, message body, and any attachments. Attachments were fetched from their links, converted into an encoded form, and passed to a background script.

That script sent the stolen material to an attacker-controlled server, separating message content from files with a type setting. The design means data can leave the browser during normal email use, without a visible warning.

Researchers found detailed Korean comments, debugging text, and emoji embedded throughout the extension’s JavaScript and JSON files.

Those traits strongly suggest generative AI helped create much of the code. The finding echoes concerns raised in coverage of malicious AI browser extensions, where add-ons presented as useful tools instead became surveillance mechanisms.

The extension requested access across all URLs rather than limiting itself to Gmail. That wide reach would give the code room to run on other pages, although Enki’s analysis specifically documented Gmail theft.

The campaign’s operators used a free Japanese hosting service as the extension’s command-and-control destination.

Phishing Opens Wider Access

After the shortcut file ran, its Visual Basic script contacted a command server using the infected device’s MAC address and executed a returned PowerShell script in memory.

The first script created a scheduled task called Chrome_Update, configured to run every 15 minutes. This gave the operators a simple way to update their actions after the initial breach.

The follow-on scripts surveyed installed security tools and system details, then sent the results outward. Separate scripts copied messages from Thunderbird and Outlook mailboxes.

A keylogger captured typed input, including possible passwords, into a local log. Such overlapping collection methods can make mailbox theft more damaging than a browser-only incident.

Kimsuky also installed Chrome Remote Desktop and AnyDesk, legitimate programs that can provide full remote control when misused.

The Chrome Remote Desktop setup used a Windows UAC bypass technique to run with elevated privileges, while the AnyDesk workflow hid its window and icon.

Comparable AnyDesk phishing persistence tactics show why trusted remote tools deserve the same review as unfamiliar software.

Organizations should treat unexpected OneDrive share links and downloaded shortcut files as high risk, particularly when the file icon carries the small shortcut arrow.

Enki recommends checking such files before opening them and regularly reviewing scheduled tasks, installed remote-control tools, running processes, and browser extensions. Users should remove unknown extensions and report suspicious email links instead of opening them.

Security teams can hunt for the listed indicators, block known infrastructure, and check hosts for the named task and files before attackers return.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Kimsuky Uses AI-Generated Chrome Extension to Automatically Steal Gmail Data appeared first on Cyber Security News.