DeepfakeHigh
North Korea's Kimsuky Group Reportedly Uses AI-Generated Military ID Deepfakes in Phishing Campaign
- Occurred
- Jul 17, 2025
- Published
- Sep 15, 2025
- Source
- AI Incident Database
Summary
Genians reported a phishing campaign by North Korea's Kimsuky group using purportedly AI-generated deepfake military ID cards. Emails reportedly impersonating South Korean defense institutions carried ZIP files with forged IDs whose photos were reportedly created using generative AI. When opened, hidden malware reportedly executed, downloading scripts disguised as Hancom Office updates. This reportedly marked an evolution in Kimsuky's tactics, using AI decoys to boost social engineering.
Developers
- OpenAI
Deployers
- Velvet Chollima
- THALLIUM
- Reconnaissance General Bureau
- Kimsuky Group
- Group 0094
- Emerald Sleet
- Black Banshee
- APT43
- Government of North Korea
Harmed parties
- South Korean defense personnel
- National security and intelligence stakeholders
- Government of South Korea
- General public of South Korea
- Epistemic integrity
Tags
- espionage
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: AI-generated deepfake military IDs used in phishing campaign causing potential security breach and malware distribution.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8