VULNpocalypse
MediumEcosystem changeMonitoring

Microsoft reports North Korean threat actors expanding AI use in tradecraft

Microsoft reports North Korean actors use AI to scale job-themed lures and fake personas, so developers should verify unsolicited recruiter contacts.

Published
Exploitation
No vulnerability exploitation is described in the available source, which reports AI-assisted social engineering and tooling activity according to Microsoft Threat Intelligence

What happened

Microsoft Threat Intelligence reports that North Korean threat actors are expanding their use of AI to speed up and scale existing operations. It made this assessment in a research post published on 2026-10-29 by Microsoft Security. This is Microsoft’s own assessment. The available source text contains no independent verification from other outlets, and it does not name any confirmed victims.

According to Microsoft Security, recent activity includes:

  • Jade Sleet launched campaigns through three front companies in a single week.
  • Onyx Sleet generated dozens of tailored lures in minutes.
  • Coral Sleet rapidly built a new capability to trojanize private source code repositories.
  • Diamond Sleet used AI to enhance targeting workflows, including persona development and front company creation.
  • Onyx Sleet and Pearl Sleet are using the open-source agentic AI penetration testing framework ARTEX in their operations.

Microsoft Security groups the actors by stage of AI adoption:

  • Operationalized: Jade Sleet, Coral Sleet and Jasper Sleet.
  • Accelerating: Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet.
  • Expanding: Emerald Sleet.
  • Emerging: no actors assessed at this stage.

Microsoft says these AI-enabled operations remain human-directed and have not become fully autonomous. It also says the tradecraft remains grounded in three things:

  • social engineering
  • malware delivery
  • the abuse of legitimate tools

The same Microsoft Security post describes specific activity by three actors:

  • Jade Sleet: Between June 8 and June 12, 2026, Microsoft says the actor posed as recruiters for a spoofed AI-powered blockchain intelligence company. It used software engineer-themed job offers to schedule interviews with individuals in cybersecurity, AI, blockchain and talent recruitment companies. Microsoft says it ran similar targeting through two additional front companies.
  • Jasper Sleet: Microsoft says the actor continues to use generative AI platforms to build fake digital personas. Microsoft describes the actor’s use of generative and agentic AI-assisted resume workflows as suspected.
  • Diamond Sleet: Microsoft says that since August 2026 the actor has returned to targeting the oil and gas sector for the first time since 2023. Microsoft also says it has created fake communications technology companies to approach telecommunications firms.

The source text available to this site is truncated. The article’s contents list mitigation guidance and Microsoft Defender detections, but the text provided does not include them, so their specifics are not confirmed here.

Am I affected?

According to Microsoft Security, these operations commonly target:

  • cryptocurrency and financial organizations
  • information technology companies and software supply chains
  • government entities
  • education-related organizations

Microsoft also describes targeting of other groups in the same post. These include individuals in cybersecurity, AI, blockchain and recruitment, as well as oil and gas, defense, telecommunications, and communications and internet policy organizations.

The following details are not confirmed in the available source:

  • specific victims
  • indicators of compromise
  • which private repositories were trojanized by Coral Sleet

The available text identifies no CVE or product vulnerability.

What to do now

  1. Read the full Microsoft Security post for its mitigation guidance and Microsoft Defender detections. Those details are not reproduced here because they are not in the text available to this site.
  2. Be careful with unsolicited job and interview outreach, especially for software engineer roles at AI or blockchain companies. Microsoft reports Jade Sleet used front companies, tailored domains and social media profiles for this kind of approach.
  3. Before you share information or run anything a recruiter or business partner sends, confirm that their company exists and is legitimate. Microsoft reports Diamond Sleet built fake companies with supporting websites and personas.
  4. If you hire remote technical staff, review how you validate applicants’ identities. Microsoft reports Jasper Sleet builds fake digital personas with generative AI and describes its AI-assisted resume workflows as suspected.
  5. Review who can access your private source code repositories and how changes to them are reviewed. Microsoft reports Coral Sleet built a capability to trojanize private repositories, though the method is not confirmed in the available text.

Sources