It's 2024 and North Korea's Kimsuky gang is exploiting Windows Help files

Rapid7 reports that North Korean APT Kimsuky (aka Black Banshee/Thallium/APT43) is running a campaign using poisoned CHM files (and ISO/VHD/ZIP/RAR containers) to deliver VBScript-based infostealers that collect machine and document data and establish registry persistence; Rapid7 published indicators of compromise and attributes the activity to Kimsuky with moderate confidence, identifying South Korea as the primary target and signs of activity in Germany.