Kimsuky Hackers Use AI-Generated Chrome Extension to Steal Gmail Data

**Executive summary:** North Korea-linked Kimsuky ran targeted spear-phishing campaigns against entities in South Korea and Japan using OneDrive-delivered ZIPs with malicious .lnk shortcuts that initiate hidden PowerShell/VBScript payloads, establish persistence via a scheduled task (Chrome_Update), deploy mailbox collectors and an in-memory keylogger, and install a Manifest V3 Chrome extension that steals Gmail messages and attachments; operators also used Chrome Remote Desktop and AnyDesk for remote control, and researchers observed artifacts suggesting AI-assisted extension development.