North Korean hackers turn to AI as crypto scams surge: Report

Amid a global surge in scams, North Korean hackers are now using AI as part of broader cyberattack operations. According to South Korea–based cybersecurity firm Genians, the Kimsuky group has been installing multiple AI tools on its infrastructure.

According to Genians, Kimsuky intends to use AI internally and repeatedly during cyber operations instead of depending solely on public AI chatbots. For context, Kimsuky is a cyber-espionage group associated with North Korea that targets governments, researchers, businesses, and other organizations.

Kimsuky’s spiderweb for further hacks and scams

As per Reuters, Kimsuky installed local AI tools like Ollama, GPT-4All, and Msty, which enable it to examine stolen documents without transferring private information to outside AI services.

Additionally, RAG technology, which can swiftly search and extract data from sizable collections of stolen files, was employed. The discovery of AI-agent frameworks by Genians also raised the possibility that Kimsuky is utilizing AI to automate some of its cyber operations and lessen the amount of manual labor needed.

Furthermore, Kimsuky was discovered to be utilizing speech-to-text software and Cursor, an AI coding tool. Cursor could help accelerate the development of malware and code, and speech-to-text may facilitate the search and analysis of stolen audio.

Additionally, the team is employing generative AI to produce more realistic phishing documents and messages. This makes it more difficult for victims to spot scams. 

Rise in scams and funds lost

TRM Labs reported that AI-enabled scam activity increased by about 500% in the last year. In fact, DeFiLlama data shows that the total value hacked in 2026 has so far reached $1.195 billion.

But according to data from TRM Labs, this is lower when compared to 2025. Here, as of H1 2026, hackers executed a record 207 hacks, causing losses of $972 million. However, this was less than half of the $2.3 billion that was taken in H1 2025.

Final Summary

• Kimsuky installed local AI tools to examine stolen documents without transferring private information to outside AI services.
• In the past year, AI-enabled scam activity increased by about 500%.