- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,743
Now the attack begins where the user is least waiting for a catch.
The North Korean group Kimsuky is no longer limited to the rough mailing of malicious files. In new attacks on the military and corporate structures of South Korea, the attackers faked the usual working pages, used real details of meetings and directly through the browser checked whether the victim launched the malware.
The ENKI Whitehat team reported that by the end of April 2026, Kimksuky conducted several campaigns against targets in South Korea. In one, the attackers simulated the page of installing protective software for the corporate B2B messenger, in the other they created a fake Webex page. Both scenarios were built not on accidental bait, but on trust in familiar working services.
In the campaign with protective software, the victim got to a page similar to the security component installation page. The buttons “download” and “full installation” were loaded by illegitimate programs, and droppers under the guise of installers nProtect Online Security and AhnLab Safe Transaction. After the launch, the file showed the victim a legitimate installer-bait, and in the background, decrypted and launched the next stage of infection.
The researchers noticed a curious detail: the HTML code of the fake page, the attackers copied from the page Woori Bank, changed the right service and added someone else’s logo. This move helped to quickly collect a convincing copy of the corporate page without development from scratch.
A separate campaign looked more dangerous because Kimsuky used the real Webex meeting schedule. The fake page showed a blurred entry screen to the conference, and a few seconds later asked to install a “camera update”. After pressing the button, the victim received an archive with a JSE file. The script was hidden-launching the malicious bootloader and then opened an HTML bait that redirected the user to the real Webex room.
According to ENKI Whitehat, the attackers probably hacked into the device or account of one of the participants in the meeting in advance, got access to the schedule and, based on a real event, collected a phishing page for the rest of the participants. This technique dramatically increases the credibility of the attack: a person sees a familiar meeting, learns the context and less doubts the request to establish a “renewal”.
The report separately describes the JSONPing technique. The phishing page via JSONP turned to the local server that the malware ran on the victim’s computer. The browser was following the answer as a script, and the page understood whether the malware was running. If the infection did not work, the site again showed an offer to install the desired file.
The final payload of the researchers called the HttpSpy variant. Previously, similar versions worked as one executable file, but the new chain divided the infection into several stages: installer, downloader and main module. This approach complicates the analysis and allows attackers to more flexible deliver the payload of only selected victims.
HttpSpy works as a remote Trojan. The malware communicates with the control server via HTTP POST, encrypts RC4 data, and encodes traffic in Base64. The team set allows you to execute shell commands, download and send files, take screenshots, update the configuration, check network connections, introduce DLL into another process and remove traces of presence.
To fix in the system, the malicious chain used a task scheduler or autorun through the registry. In some embodiments, the downloader checked the presence of virtual machines and analysis tools, and when VMware, VirtualBox or research utilities were detected, it completed. Such a filter helps the malware not to reveal the behavior in sandboxes and laboratories.
ENKI Whitehat has linked campaigns to Kimsuky on several grounds. In different samples, the RC4 keys, infrastructure, code templates, exported functions and the approach to the launch of DLL via regsvr32 were coined. The researchers also pointed to the intersection with the previous Kimsuky operations, including the use of the standard XAMPP HTTPS certificate on the infrastructure of the attackers and the characteristic autonomous systems.
Some phishing samples were disguised as the internal documents of South Korean companies. Two JSE files delivered the same version of HttpSpy as a fake Webex page. In one case, the bait document contained a jira username that matched the name in the PDB path of one of the downloaders.
The authors of the report believe that Kimsuky has complicated not only malware, but also the delivery itself. The group began to check the success of infection in real time, build phishing pages based on real work events and mask the installers for mandatory security components. For the victim, such an attack looks not like a suspicious letter with an attachment, but as a usual working procedure that arises right before meeting or entering the corporate service.
The North Korean group Kimsuky is no longer limited to the rough mailing of malicious files. In new attacks on the military and corporate structures of South Korea, the attackers faked the usual working pages, used real details of meetings and directly through the browser checked whether the victim launched the malware.
The ENKI Whitehat team reported that by the end of April 2026, Kimksuky conducted several campaigns against targets in South Korea. In one, the attackers simulated the page of installing protective software for the corporate B2B messenger, in the other they created a fake Webex page. Both scenarios were built not on accidental bait, but on trust in familiar working services.
In the campaign with protective software, the victim got to a page similar to the security component installation page. The buttons “download” and “full installation” were loaded by illegitimate programs, and droppers under the guise of installers nProtect Online Security and AhnLab Safe Transaction. After the launch, the file showed the victim a legitimate installer-bait, and in the background, decrypted and launched the next stage of infection.
The researchers noticed a curious detail: the HTML code of the fake page, the attackers copied from the page Woori Bank, changed the right service and added someone else’s logo. This move helped to quickly collect a convincing copy of the corporate page without development from scratch.
A separate campaign looked more dangerous because Kimsuky used the real Webex meeting schedule. The fake page showed a blurred entry screen to the conference, and a few seconds later asked to install a “camera update”. After pressing the button, the victim received an archive with a JSE file. The script was hidden-launching the malicious bootloader and then opened an HTML bait that redirected the user to the real Webex room.
According to ENKI Whitehat, the attackers probably hacked into the device or account of one of the participants in the meeting in advance, got access to the schedule and, based on a real event, collected a phishing page for the rest of the participants. This technique dramatically increases the credibility of the attack: a person sees a familiar meeting, learns the context and less doubts the request to establish a “renewal”.
The report separately describes the JSONPing technique. The phishing page via JSONP turned to the local server that the malware ran on the victim’s computer. The browser was following the answer as a script, and the page understood whether the malware was running. If the infection did not work, the site again showed an offer to install the desired file.
The final payload of the researchers called the HttpSpy variant. Previously, similar versions worked as one executable file, but the new chain divided the infection into several stages: installer, downloader and main module. This approach complicates the analysis and allows attackers to more flexible deliver the payload of only selected victims.
HttpSpy works as a remote Trojan. The malware communicates with the control server via HTTP POST, encrypts RC4 data, and encodes traffic in Base64. The team set allows you to execute shell commands, download and send files, take screenshots, update the configuration, check network connections, introduce DLL into another process and remove traces of presence.
To fix in the system, the malicious chain used a task scheduler or autorun through the registry. In some embodiments, the downloader checked the presence of virtual machines and analysis tools, and when VMware, VirtualBox or research utilities were detected, it completed. Such a filter helps the malware not to reveal the behavior in sandboxes and laboratories.
ENKI Whitehat has linked campaigns to Kimsuky on several grounds. In different samples, the RC4 keys, infrastructure, code templates, exported functions and the approach to the launch of DLL via regsvr32 were coined. The researchers also pointed to the intersection with the previous Kimsuky operations, including the use of the standard XAMPP HTTPS certificate on the infrastructure of the attackers and the characteristic autonomous systems.
Some phishing samples were disguised as the internal documents of South Korean companies. Two JSE files delivered the same version of HttpSpy as a fake Webex page. In one case, the bait document contained a jira username that matched the name in the PDB path of one of the downloaders.
The authors of the report believe that Kimsuky has complicated not only malware, but also the delivery itself. The group began to check the success of infection in real time, build phishing pages based on real work events and mask the installers for mandatory security components. For the victim, such an attack looks not like a suspicious letter with an attachment, but as a usual working procedure that arises right before meeting or entering the corporate service.
