Kimsuky APT Targets Crypto Users and Defense Officials With LNK Lures

Kimsuky, a North Korean state-linked APT, ran multiple highly sophisticated spear-phishing campaigns in early 2026 targeting cryptocurrency investors, defense officials, corporate recruiters, and academic staff. Attackers used deceptive LNK and JSE files to drop information-stealing malware that exfiltrated data via raw GitHub URLs and established covert remote access by abusing the official VSCode tunneling and OAuth device tokens; they also employed living-off-the-land techniques (certutil, schtasks, scheduled tasks), decoy files, and obfuscated PowerShell for persistence and evasion.