In one week in June, a North Korean hacking group posed as recruiters for three different fake companies, each with its own tailored domains, social media profiles and industry knowledge. Microsoft Threat Intelligence says that pace is what AI looks like inside Pyongyang's cyber operations: not new goals, but the old ones executed far faster.
The report ranks the most active North Korean groups on a four-stage scale of AI adoption and concludes that overall adoption is high. Microsoft is equally clear about the limit: it assesses that the operations remain human-directed and have not become fully autonomous.
Three groups already run on AI end to end
Microsoft places Jade Sleet, Coral Sleet and Jasper Sleet at the top "operationalized" stage, meaning AI is embedded across their whole workflow. Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet sit at "accelerating", Emerald Sleet at "expanding", and no North Korean group is still at the experimental "emerging" stage.
Jade Sleet, which IntelFusions tracks as TraderTraitor, ran the June recruiting campaign: between June 8 and June 12, 2026 it impersonated a spoofed AI-powered blockchain intelligence company to approach people in cybersecurity, AI, blockchain and recruitment, then repeated the play with two more front companies. Microsoft assesses the speed and breadth of that activity shows the group using generative AI to build target knowledge and scale outreach.
Dozens of phishing lures in minutes
The most concrete artifact in the report is a pile of PDFs. Microsoft identified over 100 lure files attributed to Onyx Sleet, created in August and September 2026 with target-specific details. File metadata showed dozens produced at a time within minutes, which Microsoft says is highly likely the output of an AI platform. The lures fed high-volume phishing against South Korean users, and rapid regeneration makes them harder to block.
Other examples in the report:
- Coral Sleet has, since April 2026, run a workflow to trojanize private GitHub repositories, a capability Microsoft says was highly likely engineered with an AI development platform.
- Sapphire Sleet likely used AI during the August 2026 Rust software compromise, whose malware used dynamic .NET compilation, most likely to evade defenses, a marked improvement on its earlier tooling.
- Jasper Sleet, the fake IT worker operation, uses AI to build resumes, interview answers and personas, and to keep multiple fake workers consistent.
- Diamond Sleet has returned to targeting the oil and gas sector for the first time since 2023 and built fake telecom companies with tailored personas.
- Emerald Sleet shows possible AI-generated voice and video.
Microsoft also names Cursor among the AI-assisted coding tools that have likely helped several groups generate, debug and obfuscate code.
Two groups now use an AI hacking agent
Since late October 2026, Microsoft has seen Onyx Sleet and Pearl Sleet using ARTEX, an open-source agentic AI penetration testing framework. The same framework has turned up in other operations, including activity we covered in AI pentest agent linked to South Korean bank breaches. Microsoft reads North Korea's quick uptake as a sign it will adopt new AI tools as soon as they appear.
Vet hires on camera, block device code flow
Because most of this activity still runs through social engineering and fake identities, much of Microsoft's advice is about people. Scrutinize staff supplied through staffing firms, check that a candidate's phone number and social profiles are not shared with other accounts, contact references by phone or video, and treat a candidate who cannot appear on camera across several interviews as a red flag. On the technical side, Microsoft recommends blocking OAuth device code flow wherever possible, turning on Safe Links and Safe Attachments, and keeping web-facing systems behind a VPN or web application firewall.
The pattern matches what we saw in North Korean fake hires used ChatGPT to pass interviews: the scam is unchanged, only the throughput is. For defenders, that means the tells still work, but there is less time to spot them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.