Kimsuky Uses OpenCode AI Agent and GitHub PATs in Operation GitPower Attacks

North Korea-linked threat actor Kimsuky has expanded its Operation GitPower activity with malicious LNK shortcuts, GitHub Personal Access Token (PAT)-authenticated payload delivery, and AI-generated decoy documents linked to the OpenCode coding agent.

Genians Security Center analyzed 13 malicious LNK samples collected between August 11 and August 19, 2026.

The files were delivered in ZIP archives and masqueraded as Korean business documents involving fund disbursements, insurance premiums, interest payments, certificate renewals, customer records, store master data updates, and Visa payments.

The shift broadens Kimsuky’s traditional lure focus beyond diplomatic, academic, and security themes toward finance and enterprise operations.

The attack begins when a victim extracts a ZIP attachment and opens a malicious Windows shortcut. Every analyzed LNK file was configured to execute PowerShell through unusually long, concealed command-line arguments.

In several cases, roughly 300 leading spaces were inserted before the command to obscure the payload from the shortcut Properties interface.

The shortcuts also used Chrome’s executable path as their icon source and embedded forged metadata claiming to be a small Hangul document modified in 2023.

In reality, the files were LNKs ranging from about 319 KB to 8.9 MB. The larger variants included excessive pseudorandom padding after the valid shortcut structure, likely intended to alter file characteristics and complicate analysis.

Inside the command line, Kimsuky concealed an encrypted loader as a space-delimited decimal array rather than standard Base64.

A custom PowerShell decoder reconstructs the second-stage script, writes it into the victim’s AppData directory, and executes it with Invoke-Expression.

Reuse of the same decoder structure, variable naming, and arithmetic constant across samples indicates a shared builder or automated LNK-generation workflow.

The decoded PowerShell loaders retrieve decoy documents and follow-on scripts from GitHub Raw Content URLs.

Rather than using anonymous downloads, the operators embedded GitHub PATs and issued authenticated requests with Authorization: token <PAT> and Accept: application/vnd.github.v3.raw headers.

This approach allows Kimsuky to use GitHub repositories as controlled staging infrastructure while complicating simple domain-based blocking.

The malware dynamically reconstructs URLs from fragmented strings to reduce static detection opportunities, downloads a decoy PDF, XLSX, or PNG file, and opens it to distract the victim while persistence is established in the background.

Persistence relies on hidden scheduled tasks masquerading as legitimate software or Windows components.

Examples include task names resembling BitLocker, MATLAB startup components, and .NET Framework NGEN jobs, often with misspellings such as “BitLockor.” The tasks execute hidden PowerShell at regular intervals, enabling recurring retrieval of additional payloads.

Genians Researchers said that, the campaign shows how the group is combining commodity cloud services, PowerShell obfuscation, scheduled-task persistence, and automated content generation to target financial and corporate users at scale.

Operation GitPower Campaign

One Visa-themed sample also used Pastebin as a secondary payload channel, executing remotely retrieved code in memory.

The diversification gives the operators an alternate delivery route if GitHub content is removed or blocked.

The most notable evolution is evidence that Kimsuky used the open-source AI coding agent OpenCode to mass-produce lure documents.

Multiple PDFs recorded opencode in both the Creator and Producer metadata fields, while the Author field remained set to “anonymous.”

Genians said the metadata values strongly suggest programmatic generation by an AI agent rather than conventional manual document authoring.koreatimes.

Researchers collected 29 decoy files but identified only 11 unique documents by hash, indicating that the group reused the same lures across repositories under randomized filenames.

Several OpenCode-linked PDFs shared the exact same creation timestamp and contained unreplaced text such as “(placeholder),” exposing incomplete LLM-generated drafts.

Other PDFs contained HeadlessChrome and Skia/PDF metadata, suggesting a second automation pipeline in which HTML content was generated and rendered into PDFs through headless Chrome.

This method produced more polished documents with templated wording and highly similar content structures, enabling rapid topic changes without rebuilding each lure from scratch.

A customer-document variant added anti-analysis checks for VMware processes, Process Hacker, x64dbg, PE-bear, Autoruns, Process Explorer, Procmon, TCPView, and other security-analysis tools.

If detected, the malware terminates, removes temporary artifacts, and deletes the PowerShell PSReadLine command-history file. It also checked for a sandbox-associated username, “Bruno.”

Organizations should prioritize EDR and threat-hunting coverage for ZIP-delivered LNK files, abnormal shortcut argument lengths, hidden PowerShell execution, conhost.exe –headless activity, and scheduled tasks with malformed BitLocker, MATLAB, or .NET-style names.

Security teams should also inspect PowerShell telemetry for GitHub Raw Content requests using PAT authorization headers, suspicious Pastebin access, AppData-based .ps1 creation, and encoded decimal-array loaders.

Operation GitPower demonstrates that AI is not replacing Kimsuky’s established tradecraft; it is accelerating the creation and diversification of convincing decoys around a mature GitHub- and PowerShell-based intrusion framework.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.