North Korea’s Kimsuky Group Deploys AI-Enhanced Chrome Extension in Targeted Cyber Espionage Campaign
North Korea-linked threat actor Kimsuky has been conducting spear-phishing campaigns against organizations in South Korea and Japan, leveraging a mix of malicious shortcuts, PowerShell payloads, and an AI-generated Chrome extension designed to exfiltrate Gmail messages and attachments. The campaign, documented by cybersecurity firm ENKI, demonstrates Kimsuky’s evolving tactics, blending commodity tools with custom malware to evade detection and maintain persistent access.
Attack Chain and Techniques
The intrusion begins with phishing emails containing OneDrive sharing links to ZIP archives. These archives contain malicious .lnk shortcut files disguised as legitimate documents, including Japanese-language political material. When executed, the shortcut triggers a hidden PowerShell command, opens a decoy PDF, and downloads a VBScript payload from the victim’s AppData directory.
The VBScript establishes command-and-control (C2) communication using the infected device’s MAC address as an identifier, then executes a server-provided PowerShell script in memory. Persistence is achieved via a scheduled task named Chrome_Update, which runs every 15 minutes, allowing attackers to remotely update payloads without redeploying malware.
Data Collection and Exfiltration
Kimsuky’s PowerShell scripts perform host profiling, identifying installed security products before exfiltrating data to attacker-controlled infrastructure. Dedicated collectors target local email clients:
- Thunderbird: Extracts recent mailbox data from mbox archives, saving messages as .eml files.
- Outlook: Gathers inbox and sent items (dated from January 1, 2026, onward), including content, metadata, and attachments.
A keylogger, compiled in-memory using inline C#, records keystrokes in %AppData%\Microsoft\ttmp1.log, reducing reliance on traditional compiled binaries.
AI-Generated Chrome Extension for Gmail Theft
The campaign’s most notable component is a malicious Chrome extension named “Gmail 자동 서버 업로더” (“Gmail Automatic Server Uploader”). The extension:
- Requests <all_urls> host access and injects content.js into matching sites.
- Monitors Gmail’s compose and message-reading interfaces, extracting metadata, content, recipients/senders, and attachment links.
- Retrieves attachments via fetch, encodes them in Base64, and transmits data to a C2 endpoint hosted on a free Japanese hosting service.
ENKI researchers identified Korean-language comments, debug strings, and Unicode emoji traits in the extension’s code, suggesting AI-assisted development to accelerate browser-stealing capabilities.
Remote Access and Privilege Escalation
Kimsuky also abused legitimate remote-access tools to maintain control:
- Chrome Remote Desktop: Installed via fodhelper.exe to bypass User Account Control (UAC) and bind to attacker-provided credentials.
- AnyDesk: Deployed with a scheduled task for persistence, while hiding windows, taskbar controls, and system-tray indicators to avoid detection.
Impact and Targeting
The campaign highlights Kimsuky’s focus on cyber espionage, particularly against South Korean and Japanese entities, using socially engineered lures and stealthy persistence mechanisms. The integration of AI-generated code and legitimate remote-access tools underscores the group’s adaptability in evading traditional security measures.
Source: https://cyberpress.org/kimsuky-hackers-use-ai-generated-chrome-extension/
ENKI TPRM report: https://www.rankiteo.com/company/enki-technologies-inc.
"id": "enk1787576685",
"linkid": "enki-technologies-inc.",
"type": "Cyber Attack",
"date": "1/2026",
"severity": "",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'location': 'South Korea, Japan',
'type': 'Organizations'}],
'attack_vector': 'Spear-Phishing',
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['.eml',
'PDF (decoy)',
'Base64-encoded attachments'],
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (PII, confidential '
'communications)',
'type_of_data_compromised': ['Gmail messages',
'Email attachments',
'Email metadata',
'Keystrokes',
'Thunderbird mbox archives',
'Outlook inbox/sent items']},
'description': 'North Korea-linked threat actor Kimsuky has been conducting '
'spear-phishing campaigns against organizations in South Korea '
'and Japan, leveraging a mix of malicious shortcuts, '
'PowerShell payloads, and an AI-generated Chrome extension '
'designed to exfiltrate Gmail messages and attachments. The '
'campaign demonstrates Kimsuky’s evolving tactics, blending '
'commodity tools with custom malware to evade detection and '
'maintain persistent access.',
'impact': {'data_compromised': 'Gmail messages, attachments, email metadata, '
'keystrokes, Thunderbird and Outlook emails',
'identity_theft_risk': 'High (PII and email data exfiltrated)',
'operational_impact': 'Persistent remote access, data '
'exfiltration, and potential privilege '
'escalation',
'systems_affected': 'Windows systems with Chrome, Thunderbird, or '
'Outlook installed'},
'initial_access_broker': {'backdoors_established': ['PowerShell payloads',
'Scheduled tasks',
'Chrome Remote Desktop',
'AnyDesk'],
'entry_point': 'Phishing emails with OneDrive '
'sharing links'},
'motivation': 'Cyber Espionage',
'post_incident_analysis': {'root_causes': ['Spear-phishing',
'Malicious shortcuts (.lnk files)',
'UAC bypass (fodhelper.exe)',
'Legitimate remote-access tool '
'abuse']},
'references': [{'source': 'ENKI'}],
'response': {'third_party_assistance': 'ENKI (cybersecurity firm)'},
'threat_actor': 'Kimsuky (North Korea-linked)',
'title': 'North Korea’s Kimsuky Group Deploys AI-Enhanced Chrome Extension in '
'Targeted Cyber Espionage Campaign',
'type': 'Cyber Espionage'}