Deepfake IDs and AI-Powered Phishing: New Kimsuky Campaign Hits in July 2025
In mid-July 2025, security teams detected a sophisticated spear-phishing campaign that combined generative AI deepfakes with old-school obfuscation to bypass traditional antivirus controls. Cybercriminals attributed to the Kimsuky group used AI-generated images of government ID cards embedded in phishing lures that tricked recipients into downloading malicious archives. AI Deepfake Phishing Threat The attacks impersonated military and security organizations and asked targets to “review” draft ID cards. When victims opened the attached archive, an elaborate multi-stage infection chain unfolded: a shortcut file invoked cmd.exe to create a long environment variable, then used character-slicing techniques to reconstruct obfuscated commands. Those commands fetched two payloads from South Korean command-and-control servers — a deepfake PNG created with generative AI and a batch script that executed immediately. Analysts found the campaign used a mix of AutoIt and PowerShell payloads. The...