Microsoft Threat Intelligence says North Korean hacking groups are using AI to move faster: building fake companies, writing job lures in minutes, and speeding up malware work. The report, published October 29, also says these operations are still directed by humans, not run by autonomous AI.

Coffee summary

  • FACT: Microsoft identified AI use across eight North Korean groups and rates their overall adoption as high.
  • FACT: Three groups, Jade Sleet, Coral Sleet, and Jasper Sleet, have “operationalized” AI across their work. Four more are “accelerating,” and one is “expanding.”
  • FACT: Onyx Sleet created more than 100 target-specific PDF lures in August and September 2026, often dozens within minutes, which Microsoft says was highly likely AI output.
  • FACT: Since late October, Onyx Sleet and Pearl Sleet have used ARTEX, an open-source AI penetration-testing framework, in live operations.
  • FACT: Microsoft says the activity remains human-directed and has not become fully autonomous.

What happened

Microsoft sorted North Korean groups into four stages of AI adoption: emerging, expanding, accelerating, and operationalized. It found no group still at the emerging stage.

Some examples from the report:

  • Jade Sleet posed as recruiters for three front companies between June 8 and June 12, 2026, including a fake AI-powered blockchain intelligence firm.
  • Jasper Sleet uses AI to build fake worker personas and resumes, and to keep several personas consistent.
  • Coral Sleet has, since April 2026, trojanized private GitHub repositories, a capability Microsoft says was highly likely built with an AI coding platform.
  • Diamond Sleet created fake telecom companies with websites and personas to approach real telecom firms.

Microsoft says AI coding tools such as Cursor likely helped several groups write, debug, and convert code.

Why it matters

North Korean operations are mostly about money and intelligence. Their main methods have not changed: social engineering, malware, and abuse of legitimate tools. OPINION: What AI changes is speed and polish. A fake recruiter with a believable company, tailored message, and natural English is much harder to spot than the clumsy phishing of a few years ago.

What changed, at a glance

Area How AI is used, per Microsoft
Reconnaissance Researching targets, roles, wallets, and cloud services
Social engineering Tailored lures, translation, fake resumes, altered photos, voice, and video
Tooling Writing, debugging, and converting code; faster retooling after detection
Scaling Managing many personas, summarizing stolen data, automating repetitive tasks

Who should care

  • Hiring managers and HR teams, especially those hiring remote developers.
  • Developers who get unexpected job offers with coding tests or repositories to clone.
  • Crypto, finance, and software companies, which the report lists as common targets.
  • Security teams tracking AI-assisted attacks.

Limitations and open questions

  • One vendor’s view. The findings come from Microsoft’s own telemetry and investigations.
  • “Highly likely” is not proof. Several AI links are assessments, such as inferring AI use from file metadata.
  • Product mentions. The mitigation section points to Microsoft’s own security products. The general advice applies whatever tools you use.

What to do next

  1. Verify candidates on camera across more than one video call. Microsoft treats repeated camera or microphone “problems” as a red flag.
  2. Check references by phone or video, not email only, and look for a real digital footprint.
  3. Search for duplicate personas, such as near-identical profiles or a phone number shared across accounts.
  4. Never run a “coding test” repository on a work machine. Use a disposable sandbox.
  5. Turn on phishing protections and run awareness training that includes fake recruiter scenarios.

AIImpish Take

This report is less about scary new AI weapons and more about familiar scams getting faster and more convincing. The best defenses are still basic: verify people, sandbox unknown code, and slow down when a dream job arrives too quickly.

Related on AIImpish

Sources: Microsoft Security Blog, Tracking AI adoption in North Korean threat actor tradecraft; TokenPost, Microsoft Identifies AI Use Across Eight North Korean Hacker Groups.