Reported by 2 outlets
Kimsuky deploys AI-generated decoys in evolving GitHub PAT-based LNK attack campaign
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.25 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve
malware.news · 37d ago · September 6th, 2026
◈ Key Findings Evidence of follow-on distribution using malicious LNK files contained in ZIP archives identified in Kimsuky-linked attack activity Traces of the AI agent "opencode" identified in decoy PDF metadata, showing the continued use of AI and LLMs to mass-produce decoys All LNK files configured to launch PowerShell, with encrypted loaders concealed within lengthy execution arguments Decoy documents and follow-on PowerShell commands retrieved from GitHub Raw Content paths using a GitHub PAT Anti-analysis logic designed to detect analysis tools and virtualization processes and terminate execution when specific conditions are met Need to strengthen EDR-based detection and threat hunting for the abuse of LNK files, PowerShell, and GitHub Article Link: Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve
-
update from gbhackers.com
Kimsuky Uses OpenCode AI Agent and GitHub PATs in Operation GitPower Attacks
gbhackers.com · 36d ago · September 7th, 2026
North Korea-linked threat actor Kimsuky has expanded its Operation GitPower activity with malicious LNK shortcuts, GitHub Personal Access Token (PAT)-authenticated payload delivery, and AI-generated decoy documents linked to the OpenCode coding agent. Genians Security Center analyzed 13 malicious LNK samples collected between August 11 and August 19, 2026. The files were delivered in ZIP archives […] The post Kimsuky Uses OpenCode AI Agent and GitHub PATs in Operation GitPower Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .