Kimsuky Abuse of Legitimate Remote Control Tools

In the first half of 2026, the Kimsuky threat group conducted spear phishing campaigns targeting entities in South Korea and Japan. The attacks utilize OneDrive links to deliver malicious LNK files that establish persistence via scheduled tasks. These tasks execute PowerShell scripts designed to exfiltrate system profiles, steal local email data from Outlook and Thunderbird, and deploy additional payloads.

Technically, the actor is notable for bypassing User Account Control (UAC) via `fodhelper.exe` and abusing legitimate software, including AnyDesk and Chrome Remote Desktop, to maintain stealthy remote access. Furthermore, the group utilized a malicious Chrome extension for Gmail exfiltration that appears to have been developed using generative AI, indicated by extensive Korean-language comments and debug strings in the code.

This campaign underscores Kimsuky's evolving tradecraft, combining traditional phishing with AI-assisted development and the abuse of trusted applications. The targeting of high-profile sectors in Northeast Asia remains consistent with their established espionage objectives.