Ledger / 17 Jul 2025
Kimsuky phishing uses ChatGPT-made fake South Korean military IDs
Confirmed
Genians' metadata analysis of the PNG lures identified ChatGPT as the generator; the OpenAI/other-vendor angle is covered elsewhere.
The attackers sent emails posing as a defense ID agency with deepfake military ID images. Genians' analysis found the images were produced with ChatGPT. Opening the attachment ran scripts that enabled data theft and remote access.
“Emergence of APT attacks using generative AI "ChatGPT”Genians Security Center
Sources
- AI-Driven Deepfake-Based Military ID Forgery APT CampaignGenians Security Center · 15 Sep 2025 · primary source
- North Korean operation uses ChatGPT to forge military IDsThe Record · 15 Sep 2025 · secondary source
- Date
- 17 Jul 2025
- Disclosed
- 15 Sep 2025
- Actor
- Kimsuky (APT43) (nation state), as attributed by Genians Security Center
- Nexus
- North Korea
- Targets
- South Korean defense-related institutions, journalists, researchers, activists
- What the AI did
- Deepfake, Phishing content, Social engineering
- Model
- ChatGPT
- Model family
- OpenAI
- Model basis
- stated by researcher
- Autonomy
- assist
- Outcome
- Spear-phishing with forged ID image lures delivered malware via ZIP and AutoIt/batch scripts.