Phishing campaigns linked to North Korea have been spotted targeting KakaoTalk’s desktop version to infect systems and spread malicious software to selected contacts.

South Korean cybersecurity firm Genians attributes these actions to a hacking group known as Konni.

“The initial entry point was a spear-phishing email designed to appear as an appointment notification for a North Korean human rights lecturer,” Genians Security Center (GSC) stated in their analysis.

“The spear-phishing attack led the victim to open a malicious LNK file, which resulted in a remote access malware infection. This malware remained hidden and active on the victim’s computer for a significant time, stealing internal files and sensitive data.”

Reports indicate the attacker maintained access to the compromised system for a prolonged period, using it to exfiltrate internal documents and propagate malware to specific contacts through the KakaoTalk application.

The attack is significant because it exploits trust associated with compromised individuals to deceive and capture new targets. This isn’t the first instance of Konni utilizing the messaging app for distribution. In November 2025, the group was discovered using active KakaoTalk sessions to send malicious ZIP files to victims’ contacts, while simultaneously remotely wiping their Android devices using stolen Google account details.

This recent attack begins with a spear-phishing email that lures recipients into opening a ZIP attachment containing a Windows shortcut (LNK). When executed, the LNK file downloads a subsequent payload from an external server, establishes persistence via scheduled tasks, runs the malware, and shows a decoy PDF document to distract the user.

The downloaded malware, written in AutoIt, is a remote access trojan (RAT) called EndRAT (also known as EndClient RAT). It enables the attacker to remotely control the compromised host by providing capabilities for file management, remote shell access, data transfer, and persistence.

Further investigation of the infected host has revealed various malicious components, including AutoIt scripts related to RftRAT and Remcos RAT. This suggests the attacker considered the victim important enough to deploy numerous RAT families for improved resilience.

A key aspect of the attack is the attacker’s use of the compromised victim’s KakaoTalk application to spread malicious ZIP files to their contacts and deploy the malware. This effectively turns existing victims into stepping stones for additional attacks.

“This campaign is considered a complex, multi-stage attack that goes beyond basic spear-phishing by incorporating long-term persistence, information theft, and account-based redistribution,” Genians noted. “The attacker selected specific contacts from the victim’s contact list and sent them additional malicious files, using filenames disguised as North Korea-related materials to encourage recipients to open them.”