North Korean hackers targeting South Korea churn out at least 100 phishing documents with AI

[Financial News] An assessment has found that North Korean hacking groups are using artificial intelligence (AI) to scale up cyberattacks targeting South Korean users, producing dozens of phishing lure documents in just minutes. Analysts say their methods are growing more sophisticated: the groups have produced at least 100 phishing documents tailored to individual targets and are using AI-based penetration-testing tools in real operations.
According to IT industry sources on the 30th, Microsoft (MS) Threat Intelligence (MSTIC) disclosed these findings in a report on North Korean hacking groups’ use of AI, released on the 29th (local time).
The report says that the North Korean hacking group Onyx Sleet produced at least 100 PDF lure documents tailored to individual targets in this past August and September. Analysis of file metadata showed that Onyx Sleet generated dozens of documents in succession in just minutes. Microsoft assessed that the documents were very likely created using AI platforms and that this automation is supporting large-scale phishing attacks targeting South Korean users. The report notes that the ability to rapidly regenerate and modify phishing documents could make the attacks harder to detect and block.
The use of AI is expanding beyond phishing-document creation to actual infiltration operations. Microsoft confirmed that, since late October, Onyx Sleet and Pearl Sleet have used the open-source agentic AI penetration-testing framework ARTEX in cyber operations. 
AI is also being used to develop malware. Since this past April, Coral Sleet has integrated the practice of inserting malware into private GitHub repositories into its existing attack framework. Microsoft assessed that, given the speed and scale at which new capabilities were implemented, it was very likely that AI-based development platforms had been used.
Three of North Korea’s eight major hacking groups have reached the highest level of AI adoption, classified as “fully embedded.” Microsoft divided AI adoption into four stages—initial, expansion, acceleration, and fully embedded—and rated Jade Sleet, Coral Sleet, and Jasper Sleet as fully embedded. Four groups—Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet—were classified at the acceleration stage, while Emerald Sleet was placed at the expansion stage. No group remained at the initial-experimentation stage.
North Korea’s cyberattacks, however, are not yet fully autonomous. Microsoft assessed that while AI supports reconnaissance, malware development, and the automation of repetitive tasks, humans still direct the targets and overall course of operations. The analysis says North Korean hacking groups are also adopting AI to increase the speed and efficiency of their operations while maintaining their existing objectives, including generating revenue and gathering strategic intelligence.
[email protected] Choi Hye-rim Reporter