ChainThink reports that on October 30, according to Microsoft’s threat intelligence team, among the eight North Korean hacking groups they are tracking, three have fully integrated AI into their attack processes, four are in rapid adoption phases, and one is expanding its application scope.
AI is used for target reconnaissance, social engineering, identity spoofing, and malware development, but current attacks of this nature are still primarily human-driven and have not yet achieved full autonomy.
The report states that North Korean hacker groups primarily conduct cyberattacks to generate revenue for the regime and collect strategic intelligence, targeting cryptocurrency and financial institutions, IT companies, software supply chains, governments, and educational institutions.
Relevant organizations use AI to research companies, employees, wallets, exchanges, and DeFi business processes, and bulk-generate phishing, recruitment, and investment bait content, forging resumes, avatars, voice recordings, and videos;
One organization generated over 100 customized phishing PDF files targeting Korean users between August and September 2026.
Microsoft also found that some North Korean hacker groups are using AI programming tools such as Cursor to develop and debug malware, and have begun adopting the open-source AI agent penetration testing framework ARTEX.
Microsoft recommends that businesses enhance phishing protection and malware detection, and rigorously verify the identities of remote job applicants.