Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve
The North Korean hacking group Kimsuky is sending fake financial files with malicious shortcuts (.lnk) to government and finance workers. These files use GitHub tokens to hide their command center and load malware that can spy on your computer, with some files even using AI to make the fake documents look real.
- Report priority
- Medium
- Targets
- Threat actor: Kimsuky+2 more
How it works
- Kimsuky sends fake financial documents (PDFs, Excel files, or images) that look real but contain hidden shortcut (.lnk) files.
- When you open the fake document, the shortcut runs a malicious PowerShell script that downloads more malware from GitHub using stolen access tokens.
- The malware then tries to hide itself by mimicking normal software like BitLocker or MATLAB.
- Some fake documents were even created with AI tools like 'opencode' and HeadlessChrome to make them look more convincing.
What to do
If you work in finance or government and recently opened a fake financial document (PDF, Excel, or image) sent via email or messaging apps, check your computer for unusual scheduled tasks, especially ones named after software like BitLocker or MATLAB. If you see anything suspicious, stop using the file immediately and scan your computer with antivirus software.
Do not open any unexpected financial documents, especially if they come from unknown senders. If you suspect you've opened a malicious file, disconnect from the internet, run a full antivirus scan, and contact your IT department or cybersecurity team right away. For more details, check the AlienVault OTX report linked in the source.
Technical details
Affected software: Threat actor: Kimsuky, Finance, Government
A finance worker in South Korea receives an email with a fake invoice PDF. When they open it, a hidden shortcut runs a PowerShell script that connects to a GitHub page controlled by Kimsuky to download spyware. The spyware then creates a fake scheduled task to keep running in the background, even after the computer restarts.
Kimsuky's Operation GitPower campaign (tracked as OTX-6a9e70fd7eb74853a795cc57) deploys malicious LNK shortcut files disguised as financial or business documents (PDF, XLSX, PNG) to deliver payloads via GitHub Personal Access Tokens (PATs) for command-and-control (C2). Between August 11, 19, 2026, 13 variants used obfuscated PowerShell loaders, evaded analysis via virtualization detection, and relied on Pastebin as a fallback C2 server. Decoy files incorporate AI-generated content via the opencode coding agent and HeadlessChrome PDF conversion, though placeholder text remains unrefined.
Persistence is achieved through hidden scheduled tasks impersonating legitimate software (e.g., BitLocker, MATLAB), while hardcoded GitHub PATs fetch raw payloads. Behavioral anomalies remain detectable through endpoint monitoring.