North Korean Hackers Weaponize AI to Bypass Email Filters in Blockchain Sector Attacks
AI-generated malware is now bypassing email filters by exploiting Google's ad click tracking system, as North Korean hackers target blockchain developers with a multi-stage PowerShell backdoor.
The Genians Security Center analyzed the attack as a case that "effectively bypassed email security filtering and user vigilance through a spear-phishing attack vector that exploited the ad click redirection mechanism used within the Google advertising ecosystem."
"This attack is analyzed as a case that effectively bypassed email security filtering and user vigilance through a spear-phishing attack vector that exploited the ad click redirection mechanism used within the Google advertising ecosystem," said the Genians Security Center.
Konni (also known as Earth Imp, TA406, etc.) has expanded its targeting to Japan, Australia, and India, using AI-generated PowerShell malware to exploit blockchain developers. The latest campaign, Operation Poseidon, uses ZIP files hosted on Discord's CDN containing LNK shortcuts that execute EndRAT via AutoIt scripts disguised as PDFs.
The PowerShell backdoor includes anti-analysis checks, UAC bypass via FodHelper, and leverages Microsoft Defender exclusions to establish persistence. Check Point Research noted that the introduction of AI-assisted tooling suggests an effort to accelerate development and standardize code while continuing to rely on proven delivery methods and social engineering.
"The introduction of AI-assisted tooling suggests an effort to accelerate development and standardize code while continuing to rely on proven delivery methods and social engineering," said Check Point Research.
Other North Korea-linked campaigns include JSE scripts mimicking HWPX files, LNK-based MoonPeak RAT, and Andariel's 2025 ERP vendor compromise distributing StarshellRAT, JelusRAT, and GopherRAT. These campaigns share common tactics like social engineering and multi-stage payloads but differ in their specific delivery mechanisms and target industries.
