This campaign by the threat actor Kimsuky involved spear phishing attacks against targets in Northeast Asia, specifically South Korea and Japan, during the first half of 2026. Attackers distributed LNK malware through OneDrive links, which created scheduled tasks to periodically download PowerShell scripts from command-and-control servers. These scripts performed system profiling, exfiltrated Thunderbird and Outlook email data, and logged keystrokes. To maintain stealth and persistence, Kimsuky installed legitimate remote control software including Chrome Remote Desktop and AnyDesk. Additionally, a malicious Chrome extension aimed at stealing Gmail credentials was deployed, characterized by AI-generated code with Korean-language comments and Unicode emojis. The adversary employed rotating infrastructure and compromised legitimate Korean servers as C2 nodes to complicate detection and tracking.

The campaign enabled the threat actor to gain persistent remote access to victim systems, evade antivirus detection by using legitimate remote control tools, and exfiltrate sensitive email data from Thunderbird, Outlook, and Gmail accounts. The use of scheduled tasks and PowerShell scripts allowed continuous system profiling and keystroke logging, increasing the risk of credential theft and further compromise. The operation's use of compromised legitimate servers for command-and-control infrastructure complicated incident response and attribution efforts.

No official patches or fixes apply as this is a threat actor campaign rather than a software vulnerability. Defenders should focus on detecting and blocking spear phishing attempts, monitoring for suspicious LNK files and scheduled tasks, and identifying unauthorized installations of remote control software such as Chrome Remote Desktop and AnyDesk. Monitoring network traffic for connections to known command-and-control URLs and hashes provided can aid detection. Removal of the malicious Chrome extension and user education on phishing risks are also recommended.