North Korean cybercriminals are using an artificial intelligence (AI) coding agent to mass-produce decoy documents for a malware campaign, providing new evidence that the country’s threat groups are incorporating self-directed AI into attack preparation and operations, according to a South Korean cybersecurity firm.

In a recent phishing campaign, the Pyongyang-backed cybercriminal group Kimsuky was observed using “opencode,” an AI coding agent capable of generating decoy documents from natural-language instructions, Genians said in a report published Monday.

Genians found the name of the AI tool in the metadata of some PDF files, offering unusually direct