North Korean Group Targets South With Military ID Deepfakes

The North Korea-linked group Kimsuky has begun using ChatGPT and other AI services to generate images for fake identities, aimed at strengthening social engineering and obfuscating code execution, according to Dark Reading. In the latest attack, the group used deepfakes of South Korean military identification documents to try to persuade targets such as journalists, researchers and human-rights activists to click a link, an analysis published on 15 September 2025 by Genians states.

The aim was to tailor the identities to the recipient’s work context, boosting the perceived relevance of the email content. The attack targeted a defence-related institution and asked recipients to review a draft of the identity documents. Mitch Haszard of Recorded Future notes that PurpleDelta and PurpleBravo have used AI for generating code, modifying documents, and translating text, highlighting the growing role of AI in North Korean operations.

The piece also cites insights from Trellix and Trend Micro on the broader trend of generating synthetic identities to support phishing and social engineering.