North Korea’s Kimsuky builds a local AI stack for crypto attacks
Researchers found the state-linked group using local language models to create polished finance lures while Git-based tools delivered malware.
What happened
Genians researchers linked Kimsuky to locally operated language-model tools used to produce polished crypto and finance phishing material. Git-based infrastructure then helped deliver malware, reducing the group’s dependence on public AI services.
Why it matters
Cheap, private AI tooling makes targeted phishing faster to produce and harder for crypto teams to dismiss at a glance.
Watch next
New lures that combine local language models with trusted developer infrastructure and stolen executive identities.