Kimsuky weaponizes OpenCode agent for phishing decoys

// 1h agoSECURITY INCIDENT

Kimsuky weaponizes OpenCode agent for phishing decoys

ANNOUNCEMENT PRODUCT GITHUB PRODUCT HUNT X

Cybersecurity firm Genians revealed that threat group Kimsuky has evolved its Operation GitPower campaign by integrating the open-source AI coding agent OpenCode to mass-produce spear-phishing decoys. Forensic analysis of malicious shortcut files and decoy PDFs identified OpenCode in document metadata alongside synchronized timestamps and unedited placeholders, confirming autonomous agents are being deployed directly in attack staging pipelines.

// ANALYSIS

Threat actors have progressed from asking chatbots to draft phishing emails to plugging autonomous AI coding agents directly into automated malware and lure-generation pipelines, sacrificing operational hygiene for scale. The explicit presence of OpenCode and HeadlessChrome in PDF metadata demonstrates automated workflows generating lures and rendering HTML templates to PDFs in bulk. Synchronized batch timestamps and unedited artifacts like placeholders prove these campaigns outpace human review. Defending against agent-driven attacks now requires inspecting file structural anomalies, browser-automation metadata signatures, and unusual GitHub token traffic rather than relying on document appearance.

// TAGS

kimsukyopencodecybersecuritythreat-intelligencegenerative-aispear-phishingmalwareoperation-gitpower

DISCOVERED

1h ago

2026-09-11

PUBLISHED

19h ago

2026-09-10

RELEVANCE

8/ 10

AUTHOR

rst_cloud

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

TUTORIAL1h ago

Helmryth creator argues against multi-agent bloat

In an architectural deep dive, Helmryth creator Divyam Talwar challenges the assumption that adding more agents linearly scales judgment, arguing that extra responders multiply routing overhead and verification debt. Using examples from Helmryth, he outlines explicit routing contracts—named leads, selected specialists, and full crews—to enforce single-owner accountability over superficial team expansion.

MODEL2h ago

NASA and IBM release Lunar Foundation Model

NASA and IBM have publicly released the NASA-IBM Lunar Foundation Model, an open-source geospatial AI system designed specifically for planetary science and lunar exploration. Developed under the Prithvi model family and made available on Hugging Face and GitHub, the model was trained on SomBench—a comprehensive dataset aggregating data from nine instruments across four missions, notably spanning 17 years of Lunar Reconnaissance Orbiter (LRO) observations across more than 30 spatially aligned data layers. The system outperforms traditional mapping techniques by up to 23% in accuracy, enabling automated identification of water-ice deposits in permanently shadowed regions, geological features like volcanic patches, and crater hazards to assist mission planning for NASA's Artemis program.

NEWS2h ago

OCI revenue surges 121% with $664B backlog

Oracle's AI cloud business experienced rapid growth with Oracle Cloud Infrastructure (OCI) revenue surging 121% year-over-year and its total contract backlog reaching $664 billion. However, the aggressive infrastructure expansion required $28.5 billion in quarterly capital expenditures, pushing free cash flow into negative territory and sparking debate over how quickly these heavy AI investments will translate into sustained shareholder returns.

Kimsuky weaponizes OpenCode agent for phishing decoys