ChainThink report, October 30: According to Microsoft Threat Intelligence team, among the eight North Korean hacker groups under their surveillance, three have fully integrated AI into their attack workflows, four are in rapid deployment phase, and one is expanding its application scope.

AI is being leveraged for target reconnaissance, social engineering, identity spoofing, and malware development; however, these attacks remain human-driven and have not yet achieved full autonomy.

The report states that North Korean hacking groups primarily conduct cyberattacks to generate revenue for the regime and gather strategic intelligence, targeting cryptocurrency and financial institutions, IT enterprises, software supply chains, government bodies, and educational organizations.

These groups utilize AI to analyze corporations, employees, digital wallets, exchanges, and DeFi operational processes, mass-generating phishing, recruitment, and investment bait content, while forging resumes, profile pictures, voice clips, and videos.

One group generated over 100 customized phishing PDFs tailored for South Korean users between August and September 2026.

Microsoft also discovered that certain North Korean hacker groups are employing AI coding tools such as Cursor to develop and debug malware, and have begun adopting open-source AI Agent penetration testing frameworks like ARTEX.

Microsoft recommends that enterprises strengthen anti-phishing defenses and malware detection capabilities, and rigorously verify the identities of remote job applicants.