Phishing is becoming easier to scale as threat actors begin incorporating AI into the preparation of their campaigns. Instead of manually creating every lure, attackers can use AI tools to rapidly produce documents that look convincing enough to support large-scale social engineering operations.
According to Cybersecurity News, Kimsuky hackers have been observed using the OpenCode AI agent to mass-produce phishing decoys and then hiding malware inside Windows shortcut files. The activity is associated with the Kimsuky-linked Operation GitPower cluster. Researchers examined 13 samples collected between August 11 and 19, 2026, containing financial and corporate-themed lures.
The campaign combines AI-assisted content generation with malicious LNK files, hidden PowerShell execution, GitHub-based payload delivery, scheduled-task persistence, and anti-analysis techniques.
The most notable development in this campaign is the evidence that OpenCode was involved in generating several PDF phishing lures.
Researchers found OpenCode listed in the Creator and Producer metadata of multiple documents. Four documents shared the same August 16 creation timestamp, while their Author field remained “anonymous.”
This supports the assessment that the documents were automatically produced rather than individually assembled by an operator.
The generated documents were not always polished.
Some contained unreplaced placeholder information involving:
This suggests that the attackers were prioritizing speed and volume, allowing imperfect drafts to enter the campaign.
Other PDFs contained HeadlessChrome and Skia/PDF metadata, indicating another workflow in which HTML content was generated and then rendered into PDF documents.
Researchers recovered 29 decoy files, but only 11 unique documents by MD5, indicating that duplicated content was redistributed under randomized filenames.
The campaign begins with spearphishing messages containing ZIP archives.
Inside the ZIP file is a malicious Windows LNK shortcut disguised as a document. The shortcuts can use browser-style icons and false file information to make them appear legitimate.
When the victim opens the LNK file, the attack has two simultaneous objectives.
The shortcut displays a decoy document to maintain the appearance of legitimate activity, while it silently launches PowerShell to continue the infection chain.
This creates a dangerous separation between what the victim sees and what the computer is actually doing.
Every analyzed LNK file launched PowerShell with an encrypted loader embedded inside its command-line arguments.
The commands were extremely long, ranging from approximately 5,800 to 9,500 characters.
The attackers also inserted approximately 300 leading spaces before the actual command.
That padding helps push the malicious content out of view in the shortcut properties window. The additional data also increases file size, making basic inspection and some automated security checks more difficult.
Once the hidden content is decoded, the loader retrieves additional components from GitHub Raw Content using a hardcoded personal access token.
The decoded loader downloads a decoy and a follow-on script from GitHub.
It then creates randomly named PowerShell files in locations such as:
PowerShell is launched through:
conhost.exe –headless
The malware also registers hidden scheduled tasks that imitate legitimate components, including:
These tasks provide persistence while attempting to blend into legitimate Windows activity.
One Visa-themed variant also retrieved code from Pastebin, giving the operators a second delivery route if GitHub access is blocked.
The use of trusted developer and content platforms makes domain-based detection more difficult because traffic to these services can appear legitimate without behavioral context.
The newer variants include additional anti-analysis techniques.
The malware checks for:
When it detects what appears to be a research environment, it can delete PowerShell command history.
Some incomplete builds also display error documents, although the persistence and payload retrieval stages can still execute.
This gives the campaign another layer of protection against researchers and automated analysis systems.
Viewed individually, many of the components used by Kimsuky are legitimate.
PowerShell is legitimate.
GitHub is legitimate.
Pastebin is a legitimate online service.
Windows Task Scheduler is legitimate.
The malicious behavior becomes much clearer when these events are connected:
Spearphishing email → ZIP archive → malicious LNK → decoy document → hidden PowerShell → encrypted loader → GitHub/Pastebin payload retrieval → PowerShell files in AppData/Temp → conhost.exe execution → hidden scheduled task → persistence
The newer variants then add virtual machine checks, analysis-tool detection, username checks, and PowerShell history deletion.
This is why behavior-based detection is more durable than relying on a single domain, filename, or malware hash.
Kimsuky’s use of OpenCode is significant because it introduces AI into the preparation stage of the attack.
The AI agent is not being used as the malware itself. Instead, it appears to be helping threat actors produce phishing content more efficiently.
That distinction matters.
The compromise still depends on conventional techniques such as malicious shortcuts and PowerShell. But AI-assisted content generation can make it easier for attackers to produce more lures, more variations, and more convincing documents.
The campaign therefore illustrates an emerging pattern:
AI can accelerate the human side of an attack even when the technical exploitation chain remains conventional.
The campaign provides several behavioral indicators that organizations can use for detection.
Security teams should pay particular attention to:
The strongest detection comes from correlating multiple behaviors rather than treating each indicator independently.
This campaign has two distinct security dimensions. The first is the AI-assisted phishing component, while the second is the actual endpoint compromise chain.
That makes several Seceon capabilities relevant.
The use of OpenCode AI to generate phishing decoys highlights an emerging risk: threat actors can use AI agents to accelerate portions of the attack lifecycle.
Seceon’s upcoming aiTRiSM is relevant to this evolving AI security challenge by providing visibility and governance around AI systems and AI usage across the enterprise.
It is designed to help organizations:
In the context of Kimsuky, aiTRiSM should be viewed as addressing the emerging AI-enabled threat dimension, rather than as a replacement for endpoint detection of the LNK and PowerShell attack chain.
Seceon’s aiXDR-PMax is directly relevant to the endpoint portion of the attack.
It can help security teams identify:
This behavioral approach is particularly important because the attackers are abusing trusted Windows components rather than relying on one clearly malicious executable.
Seceon’s aiSIEM / CGuard provides cross-environment correlation.
It can connect:
This helps SOC teams connect the initial phishing event with the subsequent execution, persistence, and external communications.
Instead of investigating a suspicious PowerShell event in isolation, analysts can see how it relates to the original attachment and the network activity that followed.
aiBAS360 can help organizations validate whether their security controls can detect similar attack paths.
Controlled security validation can test scenarios involving:
This helps organizations determine whether their defenses can detect the broader attack chain rather than relying solely on known malware indicators.
The latest Kimsuky campaign shows how established phishing techniques are being combined with AI-assisted automation.
The attackers continue to rely on familiar mechanisms such as malicious LNK files, PowerShell, scheduled tasks, GitHub, and Pastebin, but the apparent use of OpenCode to mass-produce phishing decoys introduces a new dimension to the campaign.
The important distinction is that AI is currently helping accelerate the content-production side of the operation. The actual compromise still depends on a conventional endpoint attack chain.
That makes layered defense essential.
aiTRiSM can address the emerging risk of AI agents and AI-assisted activity, while aiXDR-PMax focuses on endpoint execution and persistence, and aiSIEM / CGuard connects the individual events into a broader attack timeline.
As threat actors increasingly combine AI with established attack techniques, organizations need visibility into both sides of the problem: how AI is being used and what happens on the endpoint when an attack is launched.
