{ "version": 1, "event_id": "evt_24a5120f0e0c6da6", "url": "https://xiyu.news/events/evt_24a5120f0e0c6da6/", "json": "https://xiyu.news/api/events/evt_24a5120f0e0c6da6.json", "type": "security_incident", "status": "monitoring", "category": "technology", "title": { "zh": "微软：朝鲜黑客用AI批量生成钓鱼文档，假招聘与恶意代码开发已落地", "en": "微软：朝鲜黑客用AI批量生成钓鱼文档，假招聘与恶意代码开发已落地" }, "current_state": { "zh": "微软 10 月 30 日报告进一步说明，朝鲜黑客组织已将 AI 广泛用于侦察、钓鱼、身份伪造和恶意软件开发，并将加密交易所、钱包和 DeFi 业务列为重点目标之一；报告还披露了假招聘、批量钓鱼 PDF、供应链攻击和 ARTEX 使用等具体案例。", "en": "Microsoft's Oct. 30 report further details that North Korean groups have broadly embedded AI in reconnaissance, phishing, identity fraud and malware development, with crypto exchanges, wallets and DeFi among key targets; it also cites fake recruiting, mass phishing PDFs, a supply-chain attack and ARTEX use as specific cases." }, "first_seen_at": "2026-10-30T07:01:32.550653+00:00", "last_updated_at": "2026-10-30T15:01:34.180589+00:00", "last_material_change_at": "2026-10-30T15:01:34.180589+00:00", "confidence": 0.75, "updates_count": 2, "sources_count": 2, "entities": [], "identifiers": [], "topics": [ "ai-enabled-phishing", "ai-security", "crypto-security", "lazarus-group", "north-korea", "phishing", "threat-intelligence" ], "updates": [ { "update_id": "upd_6248ec6004771e59", "event_id": "evt_24a5120f0e0c6da6", "occurred_at": "2026-10-30T05:43:02Z", "published_at": "2026-10-30T05:43:02Z", "first_seen_at": "2026-10-30T07:01:32.550653Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "微软：朝鲜黑客用AI批量生成钓鱼文档，假招聘与恶意代码开发已落地", "title_en": "微软：朝鲜黑客用AI批量生成钓鱼文档，假招聘与恶意代码开发已落地", "what_changed_zh": "微软威胁情报报告称，朝鲜黑客组织已将AI纳入日常攻击流程——大规模生成定制钓鱼文档，针对AI和区块链从业者开展虚假招聘活动，并使用Cursor和ARTEX框架等工具进行恶意软件开发与规避检测。", "what_changed_en": "Microsoft threat intelligence reports that North Korean hacking groups have moved AI into daily attack workflows — mass-generating tailored phishing documents, running fake job campaigns against AI and blockchain professionals, and using tools like Cursor and the ARTEX framework for malware development and detection evasion.", "current_state_zh": "微软威胁情报报告称，朝鲜黑客组织已将AI纳入日常攻击流程——大规模生成定制钓鱼文档，针对AI和区块链从业者开展虚假招聘活动，并使用Cursor和ARTEX框架等工具进行恶意软件开发与规避检测。", "current_state_en": "Microsoft threat intelligence reports that North Korean hacking groups have moved AI into daily attack workflows — mass-generating tailored phishing documents, running fake job campaigns against AI and blockchain professionals, and using tools like Cursor and the ARTEX framework for malware development and detection evasion.", "detailed_summary_zh": "Microsoft threat intelligence reports that North Korean hacking groups have moved AI into daily attack workflows — mass-generating tailored phishing documents, running fake job campaigns against AI and blockchain professionals, and using tools like Cursor and the ARTEX framework for malware development and detection evasion.", "detailed_summary_en": "Microsoft threat intelligence reports that North Korean hacking groups have moved AI into daily attack workflows — mass-generating tailored phishing documents, running fake job campaigns against AI and blockchain professionals, and using tools like Cursor and the ARTEX framework for malware development and detection evasion.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:203224" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/374597?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_6b694447bb108bf7", "event_id": "evt_24a5120f0e0c6da6", "occurred_at": "2026-10-30T09:10:02Z", "published_at": "2026-10-30T09:10:02Z", "first_seen_at": "2026-10-30T15:01:34.180589Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【微软：朝鲜黑客借 AI 批量钓鱼、伪造身份及开发恶意软件，加密机构为主要目标之一】", "title_en": "【微软：朝鲜黑客借 AI 批量钓鱼、伪造身份及开发恶意软件，加密机构为主要目标之一】", "what_changed_zh": "同一份微软报告补充了朝鲜黑客组织的 AI 应用分层数据：追踪的 8 个组织中 3 个全面融入 AI、4 个快速应用、1 个扩大应用；并给出 2026 年 6 月假招聘、2026 年 8 至 9 月百余份定制钓鱼 PDF、2026 年 8 月 Rust 开发者供应链攻击及 ARTEX 框架使用等具体案例。", "what_changed_en": "The same Microsoft report added a breakdown of 8 tracked North Korean groups (3 fully integrating AI, 4 rapidly adopting it, 1 expanding use) and specific 2026 campaigns, including fake AI-blockchain recruiting, 100+ tailored phishing PDFs against Korean users, a suspected AI-assisted Rust supply-chain attack, and ARTEX framework use.", "current_state_zh": "微软 10 月 30 日报告进一步说明，朝鲜黑客组织已将 AI 广泛用于侦察、钓鱼、身份伪造和恶意软件开发，并将加密交易所、钱包和 DeFi 业务列为重点目标之一；报告还披露了假招聘、批量钓鱼 PDF、供应链攻击和 ARTEX 使用等具体案例。", "current_state_en": "Microsoft's Oct. 30 report further details that North Korean groups have broadly embedded AI in reconnaissance, phishing, identity fraud and malware development, with crypto exchanges, wallets and DeFi among key targets; it also cites fake recruiting, mass phishing PDFs, a supply-chain attack and ARTEX use as specific cases.", "detailed_summary_zh": "Microsoft reported that North Korean hacking groups have broadly embedded AI across reconnaissance, phishing, identity fraud and malware development, with crypto exchanges, wallets and DeFi operations among their main targets.", "detailed_summary_en": "Microsoft reported that North Korean hacking groups have broadly embedded AI across reconnaissance, phishing, identity fraud and malware development, with crypto exchanges, wallets and DeFi operations among their main targets.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.93, "story_ids": [ "telegram:foresightnews:121790" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/116462", "label": "foresightnews", "source_type": "telegram", "official": false } ] } ] }