{"version":1,"type":"story","url":"https://digestai.news/story/microsoft-warns-north-korean-hackers-use-ai-to-scale-phishing-and-malw","json":"https://digestai.news/story/microsoft-warns-north-korean-hackers-use-ai-to-scale-phishing-and-malw.json","markdown":"https://digestai.news/story/microsoft-warns-north-korean-hackers-use-ai-to-scale-phishing-and-malw.md","slug":"microsoft-warns-north-korean-hackers-use-ai-to-scale-phishing-and-malw","headline":"Microsoft warns North Korean hackers use AI to scale phishing and malware","summary":"Microsoft Threat Intelligence reports that North Korean threat actors have adopted generative and agentic AI across their operations, using it as a force multiplier to increase the speed, scale and complexity of attacks. Groups such as Jade Sleet, Coral Sleet, Onyx Sleet, Diamond Sleet, Pearl Sleet, Sapphire Sleet and Jasper Sleet are employing AI for reconnaissance, social engineering, malware development and creating fake identities. Between June 8 and June 12, 2026, Jade Sleet ran job-themed phishing campaigns against cybersecurity, AI, blockchain and recruiting targets using tailored domains and social-media profiles. Onyx Sleet produced over 100 PDF lure files in August and September 2026, with metadata suggesting dozens were generated within minutes via an AI platform. Coral Sleet has operationalized a workflow since April 2026 to trojanize private GitHub repositories, likely engineered with AI-enabled development tools. Sapphire Sleet likely used AI in an August 2026 Rust software compromise featuring dynamic .NET compilation for defense evasion. Microsoft classifies the groups across four adoption stages: Jade Sleet, Coral Sleet and Jasper Sleet have operationalized AI; Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are accelerating; Emerald Sleet is expanding. The company stresses operations remain human-directed, with AI boosting productivity and scale rather than enabling full autonomy.","keyPoints":["Microsoft says North Korean groups use AI as a force multiplier across phishing, malware and fake-identity operations","Onyx Sleet created over 100 PDF lures in Aug-Sep 2026, with metadata indicating dozens generated in minutes via AI","Coral Sleet operationalized AI-assisted trojanizing of private GitHub repositories since April 2026"],"whyItMatters":"AI is accelerating state-backed cyber operations, letting attackers generate lures, code and personas at a pace that may outstrip defenders' ability to detect and block evolving tactics.","category":{"slug":"policy","name":"Policy & Regulation","url":"https://digestai.news/category/policy"},"entities":{"companies":["Microsoft"],"models":[],"people":[]},"firstPublishedAt":"2026-10-29T18:52:00Z","updatedAt":"2026-10-29T18:52:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"ibtimes.sg","title":"North Korean Hackers Weaponizing AI to Supercharge Phishing, Malware and Cyberattacks: Microsoft Warns","url":"https://ibtimes.sg/north-korean-hackers-weaponizing-ai-supercharge-phishing-malware-cyberattacks-microsoft-warns-95703","publishedAt":"2026-10-29T18:52:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"Microsoft warns North Korean hackers use AI to scale phishing and malware\", 29 October 2026, https://digestai.news/story/microsoft-warns-north-korean-hackers-use-ai-to-scale-phishing-and-malw","publisher":"Digest AI","title":"Microsoft warns North Korean hackers use AI to scale phishing and malware","datePublished":"2026-10-29T18:52:00Z","url":"https://digestai.news/story/microsoft-warns-north-korean-hackers-use-ai-to-scale-phishing-and-malw"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}