Kimsuky Evolves GitHub PAT-Based LNK Campaign With AI-Generated Decoys

Kimsuky-linked Operation GitPower activity distributed at least 13 malicious .LNK files in ZIP archives through spearphishing, posing as finance, insurance, payment, and retail business documents. The shortcuts execute obfuscated PowerShell loaders that use a GitHub personal access token (PAT) to retrieve decoy files and subsequent payloads from GitHub Raw Content; one Visa5499 variant also used Pastebin as a second-stage delivery channel.

The malware establishes persistence through hidden scheduled tasks disguised as legitimate software, can delete itself and PowerShell history, and checks for analysis tools, virtual-machine processes, and sandbox usernames before execution. Downloaded PDF decoys contained opencode metadata, matching creation timestamps, unreplaced temporary-value placeholders, and HeadlessChrome/Skia artifacts, suggesting an automated AI/LLM-assisted lure-production workflow. Defenders should correlate LNK-launched PowerShell, unusually long whitespace-padded command lines, .ps1 creation in AppData or Temp, masqueraded scheduled tasks, and GitHub PAT or Pastebin communications.