North Korean hacking groups leverage AI for cyberattacks

North Korea cyberattacks artificial intelligence phishing software supply chain

Microsoft threat intelligence reports that three North Korean hacking groups, including Jade Sleet, Coral Sleet, and Jasper Sleet, have reached the highest stage of AI integration, using it to automate routine operational procedures. These groups utilize generative AI for target research, creating fake identities, crafting phishing lures, and developing malware.

Specific tactics include using AI to generate hundreds of customized PDF phishing documents in minutes and employing AI coding tools like Cursor for code generation and error correction. Researchers also noted the use of the open-source AI penetration testing framework, ARTEX, by groups such as Onyx Sleet.

Beyond phishing, North Korean actors are expanding into software supply-chain compromises. A group tracked as DeceptiveDevelopment has been observed stealing developer credentials to inject malware into trusted repositories, including npm and PyPI. Additionally, North Korean IT workers have used fake identities to secure remote employment at hundreds of overseas companies, a practice that has facilitated the theft of sensitive source code and intellectual property.

Entities

Amazon Web Services · Coral Sleet · ESET · Hancom · Jade Sleet · Jasper Sleet · Kaspersky · Kim Yeon-soo · Lazarus Group · Microsoft · Nomadian · North Korea

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] North Korean IT workers used fake identities to gain employment at 309 US companies. biz.heraldcorp.com
[○ 1 SOURCE] Jade Sleet, Coral Sleet, and Jasper Sleet are classified as being at the highest stage of AI utilization. www.tokenpost.kr
[○ 1 SOURCE] Lazarus Group used AI-generated profile pictures on resume websites during Operation FlashHole. world-today-journal.com
[● 2 SOURCES] Three North Korean hacking groups have integrated AI into their daily operational procedures. www.tokenpost.kr · www.mbn.co.kr
[○ 1 SOURCE] The group DeceptiveDevelopment steals developer credentials to plant malware in repositories like npm and PyPI. cybernoz.com
[● 2 SOURCES] One North Korean organization generated over 100 customized PDF phishing documents between August and September 2026. www.tokenpost.kr · www.mbn.co.kr
[○ 1 SOURCE] North Korean hackers use AI coding tools like Cursor for code generation and error correction. www.mbn.co.kr
[● 2 SOURCES] A phishing simulation involving hygiene inspection reports resulted in a 92 percent click rate. kidd.co.kr · uzone.id