According to CoinMeta, North Korean hacker group Kimsuky is utilizing local artificial intelligence systems to create more deceptive phishing materials in preparation for automated cyberattacks. South Korean cybersecurity company Genian has discovered that Kimsuky has set up a local large-scale language model environment using Ollama, GPT4All, and Msty; these systems can run on infrastructure controlled by the attackers, reducing the risk of sensitive information being exposed. Researchers have identified bait documents related to finance and cryptocurrencies that mimic legitimate investment reports, with the aim of increasing the success rate of phishing attacks. Genian also observed the use of malicious ZIP files and LNK shortcut files, which can initiate embedded PowerShell loaders. Studies indicate that Kimsuky is integrating existing AI technologies to accumulate tools and expertise that will allow AI to be more widely integrated into future operations.