Kimsuky Uses LNK, JSE Lures to Target Recruiters, Crypto Users, Defense Officials

Kimsuky conducted at least four tailored spear-phishing campaigns in early 2026 targeting recruiters, crypto users/developers, defense personnel, and academic/public sector staff; attackers used deceptive LNK and JSE lures (hidden extensions), delivered payloads via embedded decoy documents and ZIPs, established persistence through scheduled tasks and Startup entries, and abused trusted services (GitHub, Microsoft CDN, VSCode tunnels) for C2 and payload hosting—enabling stealthy long-term access and data exfiltration while evading reputation-based detection.