Microsoft Says North Korean Groups Use AI to Scale Cyber Operations

AI · First reported 30 Oct, 01:52 · Updated 16:45

Image: Wikimedia Commons · NASA Johnson Space Center · Public domain

Microsoft reports that North Korean threat groups are applying generative and agentic AI to phishing, fake job campaigns, reconnaissance and malware development. It says the tools increase the scale and speed of operations, which remain directed by people.

Microsoft says Jade Sleet ran campaigns through three front companies in one week, while Onyx Sleet produced dozens of tailored lures within minutes.
Reported uses include researching targets, impersonating recruiters, creating fake personas and developing or adapting malicious code.
Microsoft assesses that people still direct these operations and that AI is helping advance existing objectives, including raising revenue and collecting intelligence.

Summary written by Lux AI from 2 articles

Key facts

Campaign scale: Jade Sleet used three front companies in one week, according to Microsoft.
Lure production: Onyx Sleet generated dozens of tailored lures within minutes, according to Microsoft.
Job-targeting dates: Microsoft identified Jade Sleet targeting people from June 8 to June 12, 2026.
PDF lures: Microsoft identified more than 100 Onyx Sleet PDF lure files created in August and September 2026.
Human direction: Microsoft says the operations are human-directed, not fully autonomous.