Lazarus Group uses AI-generated identities in cyberespionage campaign

Kaspersky has identified a new cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus group. The campaign utilizes artificial intelligence to create convincing fake professional profiles, including AI-generated photographs, resumes, and fraudulent portfolio websites to target corporate victims.

Active since at least July 2025, the campaign has primarily affected organizations across Asia. However, researchers warn that the techniques pose a significant risk to organizations in Latin America, where the group has a history of activity. The attacks involve highly personalized social engineering via targeted emails designed to build trust.

Technical analysis suggests the group may be exploiting a potential vulnerability in CrossWeb EX, a security software widely used in Asia. Visiting the fraudulent pages can trigger the flaw and initiate system infections.

Additionally, Kaspersky researchers noted a rise in global spam campaigns targeting the education sector. These scams use tailored messaging to lure parents and professionals into fraudulent online tutoring services or fake student loan offers, often leading to data theft or malware infections.