Microsoft says North Korean hackers now use AI to fake recruiters, forge phishing files, target crypto firms

Microsoft Threat Intelligence has rated North Korean hacking groups’ use of AI as high, saying Jade Sleet, Coral Sleet and Jasper Sleet now use it throughout their operations, from fake recruiter campaigns to phishing files and malware development. Microsoft says humans still direct every attack, but the groups are also testing agentic AI tools.

Jade Sleet, Onyx Sleet and Coral Sleet expand AI-powered attacks

Microsoft’s investigation uncovered several examples demonstrating how North Korean threat actors are using AI to improve their operational efficiency.

Jade Sleet, for instance, conducted recruitment-themed campaigns through three separate front companies within a single week. The group reportedly used convincing professional identities, tailored online infrastructure and industry-specific knowledge to approach potential victims.

The campaigns targeted individuals working in cybersecurity, artificial intelligence, blockchain and recruitment. Attackers posed as recruiters representing a fictional AI-powered blockchain intelligence company, using software engineering opportunities to establish contact and arrange interviews.

Microsoft believes generative AI helped accelerate the research, preparation and customization behind these operations.

Onyx Sleet demonstrated another application of the technology. Microsoft identified more than 100 PDF lure documents attributed to the group during August and September 2026. The files contained target-specific information, while their metadata indicated that dozens were generated within minutes.

This development demonstrates how AI adoption can make phishing operations easier to scale. Rather than manually preparing individual documents, attackers can generate multiple variations quickly and adjust their content to different targets.

Coral Sleet has also developed capabilities that present risks to software developers and organizations relying on private code repositories.

According to Microsoft, the group established a workflow for inserting trojanized code into private GitHub repositories, integrating malicious components into its existing malware operations. The company considers it highly likely that an AI-enabled development platform helped create this capability.

The implications extend beyond individual computer systems. Compromising software repositories can expose developers and organizations to supply-chain threats, potentially creating opportunities for malicious code to reach other users and connected environment.

ARTEX introduces another layer to North Korean cyber operations

Beyond generating phishing documents and assisting malware development, North Korean hacking groups are experimenting with agentic AI frameworks.

Microsoft identified Onyx Sleet and Pearl Sleet using ARTEX, an open-source agentic AI penetration-testing framework, in their operations since late October 2026.

ARTEX is designed to coordinate AI-powered offensive security activities. Its capabilities include automating different stages of penetration testing, allowing multiple AI agents to support reconnaissance and other technical operations.

Its appearance in North Korean-linked campaigns illustrates how attackers are exploring increasingly sophisticated tools rather than relying exclusively on conventional scripts and manually operated techniques.

The development is particularly significant because agentic systems can coordinate several related activities with less direct human intervention. This could reduce the time required to investigate targets, identify weaknesses and execute subsequent stages of an operation.

Microsoft has previously documented how threat actors are incorporating AI into reconnaissance, social engineering, malware development and post-compromise activities.

In its March 2026 research, Microsoft Threat Intelligence explained that malicious actors were using language models to generate phishing content, translate communications, summarize collected information and assist with malware development.

The latest findings suggest that these capabilities are becoming more deeply integrated into established attack workflows.

Nevertheless, Microsoft has not concluded that North Korean groups have achieved fully autonomous cyberattacks. Human operators continue to determine objectives, select targets and direct important operational decisions.

That distinction is important when assessing the current threat. AI adoption is increasing the efficiency of existing attack methods, but it does not mean that human involvement has disappeared.

Cryptocurrency businesses and financial institutions face growing risks

The expansion of AI-assisted cyber operations presents particular concerns for the cryptocurrency industry.

Microsoft identified cryptocurrency businesses, financial institutions, technology companies, software supply chains, government organizations and educational institutions among the sectors commonly targeted by North Korean threat actors.

For cryptocurrency companies, the exposure includes exchanges, digital wallets, decentralized finance platforms and blockchain-related businesses.

Attackers researching these organizations can use AI to develop a better understanding of their operations before approaching employees or attempting to compromise their systems.

Recruitment-themed attacks are another concern. By creating convincing professional identities and tailoring job applications to specific industries, malicious actors can exploit ordinary hiring processes to establish legitimate-looking relationships with organizations.

The software supply chain presents a separate challenge. If attackers successfully introduce malicious code into trusted repositories, the consequences could extend to developers, businesses and downstream users.

Microsoft’s findings therefore suggest that organizations should not treat AI-generated phishing messages as the only concern. The technology can support several stages of an attack, making traditional security assumptions increasingly difficult to maintain.

The company recommends stronger phishing awareness, vulnerability management, malware detection and more rigorous employee verification procedures. Organizations should also scrutinize suspicious recruitment activity, examine inconsistencies in professional identities and maintain effective endpoint security protections.

Ultimately, the latest report illustrates why AI adoption is becoming an important consideration in cybersecurity planning.

North Korean hacking groups are demonstrating that artificial intelligence can improve the speed, scale and coordination of established cyberattack techniques. As these capabilities mature, cryptocurrency companies and other high-value organizations will need to strengthen their defenses against threats that combine human-directed operations with increasingly sophisticated automation.

For now, Microsoft’s assessment offers an important qualification: the attackers are still in control of their campaigns. But the growing integration of AI into their operations suggests that the resources required to launch complex cyberattacks are continuing to decline.