Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve

Kimsuky continues its Operation GitPower campaigns with thirteen LNK file variants collected in August 2026. These files use hardcoded GitHub PATs to retrieve raw content for command-and-control, delivering obfuscated PowerShell loaders via custom decoders. The campaign has evolved with anti-analysis routines detecting virtualization tools, use of Pastebin as an alternative C2 channel, and diversified AI-generated decoys in PDF, XLSX, and PNG formats created with the 'opencode' AI coding agent and HeadlessChrome PDF conversion. Persistence is achieved through hidden scheduled tasks disguised as legitimate software such as BitLocker and MATLAB. Although evasion techniques and automation have increased, endpoint detection remains possible through behavioral correlation analysis.

This campaign enables remote attackers to execute obfuscated PowerShell loaders on victim machines, potentially allowing unauthorized command execution and persistence. The use of GitHub PATs for C2 communications and AI-generated decoys increases the sophistication and stealth of the attacks. However, no known exploits are reported in the wild, and endpoint behaviors remain detectable, indicating that while the threat is advanced, it is not currently undetectable or uncontrollable.

No official patch or fix is applicable as this is a threat actor campaign rather than a software vulnerability. Defenders should focus on detecting behavioral indicators related to obfuscated PowerShell execution, scheduled tasks masquerading as legitimate software, and unusual GitHub PAT usage. Monitoring for the provided file hashes and indicators can aid in detection. Endpoint detection and response solutions should leverage behavioral correlation to identify this activity. There is no vendor advisory indicating that no action is required; therefore, active monitoring and response are recommended.