Microsoft Finds North Korean Group Made 100+ PDF Decoys With AI

Microsoft's review of North Korean cyber activity found one group used AI to prepare more than 100 customized PDF lures for people in South Korea during August and September. That finding adds a targeting detail to Microsoft's assessment of AI use across eight North Korean groups.

Three groups were placed in Microsoft's top operationalized tier, where AI is integrated into routine attack workflows. Four were classified as accelerating, and one as expanding. Some batches of the documents yielded dozens of files within minutes.

Microsoft also flagged possible use of ARTEX, an agentic AI penetration-testing tool. The groups had not reached fully autonomous attacks, Microsoft assessed, and the effect of AI on attack success rates and costs remained undetermined.

Separately, TRM Labs attributed the theft of about $6.36 billion from 10 Binance blockchain wallets in roughly 20 minutes to TraderTraitor, a North Korean hacking group. AI use in the Binance theft remains unconfirmed.