Microsoft’s Threat Intelligence team has revealed that North Korean cyber-adversaries are now extensively integrating Artificial Intelligence (AI) into their operational workflows to enhance the efficiency of their attacks. According to a report released on October 30, 2026, prominent threat actors such as Jade Sleet, Coral Sleet, and Jasper Sleet have demonstrated a high adoption rate of these technologies. These groups primarily target cryptocurrency assets and financial institutions, utilizing AI to automate the creation of deceptive content and the identification of software vulnerabilities.
Advanced Tactics and AI Integration
The investigation by Microsoft details how different units within the North Korean hacking ecosystem utilize AI to scale their malicious activities. The report highlights specific incidents occurring throughout late 2026, showing a shift toward automated reconnaissance and social engineering.
- Jade Sleet: Executed a series of recruitment-themed phishing campaigns through three distinct shell companies within a single week.
- Onyx Sleet: Generated over 100 custom PDF lure documents during August and September, using AI to personalize content for high-value targets.
- Coral Sleet: Suspected of utilizing AI-driven development platforms to inject Trojanized code into private GitHub repositories, compromising the supply chain of various software projects.
Furthermore, since late October, both Onyx Sleet and Pearl Sleet have reportedly begun utilizing ARTEX, an open-source agent-based AI penetration testing framework. This framework allows attackers to automate the discovery of exploitable flaws within blockchain protocols and corporate networks.
Human-Led Operations and Financial Targets
Despite the increased reliance on automation, Microsoft’s analysts assess that these cyber operations remain human-led. The AI tools currently serve as "force multipliers" rather than fully autonomous agents, helping hackers refine their scripts and bypass traditional security filters. The ultimate objective of these campaigns remains the illicit acquisition of digital assets to fund state-aligned initiatives.
Microsoft assesses that these operations are still human-led and not yet fully autonomous. These operations typically target cryptocurrency and financial assets.
The use of AI in this context represents a significant evolution in the threat landscape for the Web3 and decentralized finance (DeFi) sectors. Security experts recommend that cryptocurrency exchanges and individual developers implement more rigorous code auditing and multi-factor authentication to defend against these increasingly sophisticated, AI-enhanced social engineering tactics.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.