Cybersecurity
North Korea-linked KONNI used an AI-assisted PowerShell backdoor in developer phishing campaign
Check Point documented a campaign using project documents as bait and a malicious Windows shortcut to deliver a backdoor.
Kuva: Check Point Research. Alkuperäisen KONNI-tutkimuksen kuva hyökkäyskampanjassa käytetyistä houkutusasiakirjoista.
A PROJECT BRIEF TURNED INTO A PHISHING LURE
In January 2026, Check Point Research reported a phishing campaign associated with KONNI, a group linked to North Korean cyber operations. Instead of focusing only on its earlier diplomatic targets, the group appeared to be pursuing software developers and blockchain specialists.
The bait consisted of apparently ordinary project documentation, complete with schedules, technical descriptions and budgets. The aim was to persuade recipients to open a file package containing a malicious Windows shortcut. The shortcut could trigger PowerShell and subsequently install a backdoor.
WHY BLOCKCHAIN DEVELOPERS?
These developers may have access to source code, cloud infrastructure, API credentials and systems connected with digital assets. Such access can be valuable to attackers even when the individual developer is not the ultimate target. Check Point observed samples associated with countries beyond Korea, but sample submission locations alone cannot establish a large successful victim campaign.
TRACES OF AI IN THE MALWARE CODE
The PowerShell backdoor included unusually structured components and extensive explanatory comments. Check Point interpreted these as strong signs of AI-assisted code development. The claim is a technical research assessment, not a complete transcript of the attacker's AI conversations.
The backdoor was designed to enable further activity after a successful compromise. The delivery package was also structured to obscure the step at which the malicious behavior began.
THE PROMPT ANALYSIS
The human deception remained familiar: credible-looking documents meant to induce someone to open a file. AI may have accelerated construction of the malicious software behind the lure. Organizations can reduce risk by verifying file origins, limiting workstation privileges, monitoring suspicious script execution and keeping development credentials separate.
Original source: Check Point Research, 22 January 2026. https://research.checkpoint.com/2026/konni-targets-developers-with-ai-malware/