North Korea's Kimsuky hacking group used AI tools to create fake military ID cards with deepfake photos in a phishing campaign targeting South Korean defense personnel, delivering malware when victims opened the fraudulent documents.
In July 2025, the North Korean hacking group Kimsuky launched a new phishing campaign using AI-generated fake military identification cards. The attackers sent emails appearing to be from legitimate South Korean defense institutions, containing ZIP files with what appeared to be draft military IDs. The convincing photos on these IDs were AI-generated deepfakes with 98% certainty of being fake, created using widely available AI tools like ChatGPT. When victims opened the files, malicious programs ran in the background, downloading a file called LhUdPC3G.bat from a remote server at jiwooeng.co.kr. The hackers then installed a malicious task named HncAutoUpdateTaskMachine that ran every seven minutes, disguised as a Hancom Office update. This represents an evolution from Kimsuky's previous ClickFix tactics. The cybersecurity firm Genians Security Center (GSC) detected this campaign and noted that the hackers used similar code strings like 'Start_juice' and 'Eextract_juice' in other attacks. This incident follows previous reports from June 2025 where OpenAI reported North Korean threat actors using AI to create fake identities for technical job interviews.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
No population impact data reported.