North Korean hackers using AI is no longer a side story. Microsoft tracks eight state-linked groups that now use AI, from fake job applicants to phishing lures and malware code. The good news: Microsoft also says these operations are still run by humans, not by autonomous bots.
Here’s a quick look at the facts before we get into what it means for you.
- Microsoft Threat Intelligence published the report on October 29, 2026.
- Three groups (Jade Sleet, Coral Sleet, Jasper Sleet) use AI as part of routine workflows.
- Four more (Diamond, Onyx, Pearl and Sapphire Sleet) are adopting it fast.
- Targets include remote hiring teams, telecom firms and software developers.
How North Korean hackers using AI actually work
Microsoft’s main finding is simple. AI helps these groups do the same jobs faster: make money, collect intelligence, and sometimes cause disruption. It hasn’t changed their goals.
The company groups the actors by how deeply AI is built into their work. “Operationalized” means routine use, “accelerating” means rapid growth across several tasks, and “expanding” means selected uses only.
| AI adoption stage | Groups named by Microsoft |
|---|---|
| Operationalized | Jade Sleet, Coral Sleet, Jasper Sleet |
| Accelerating | Diamond Sleet, Onyx Sleet, Pearl Sleet, Sapphire Sleet |
| Expanding | Emerald Sleet |
| Emerging | None assessed at this stage |
Fake job candidates and deepfake interviews
The most worrying part for everyday companies is hiring. Microsoft says Jasper Sleet uses AI-assisted resume workflows and fake personas to land remote jobs. Its tools help keep the story consistent across several fake workers.
Other groups run job-themed lures. Jade Sleet, Coral Sleet and Sapphire Sleet use AI to build resumes and give believable interview answers. Microsoft also found possible AI-generated voice and video from Emerald Sleet.
If you hire remote staff, that matters. A polished candidate on a video call may not be who they claim to be.
Phishing lures and AI-written malware
AI also speeds up the boring parts of an attack. Onyx Sleet produced more than 100 PDF lure files in August and September 2026, and dozens were made within minutes of each other.
On the coding side, Microsoft says AI development tools, including Cursor, likely helped four groups write, debug and refactor code. Coral Sleet has run a workflow since April 2026 to trojanize private GitHub repositories.
If your team uses AI coding tools, our guide on the Claude Code extension backdoor check shows how bad builds can slip in through the tools you trust.
Microsoft also says Onyx Sleet and Pearl Sleet have used an open-source agentic penetration-testing framework called ARTEX since late October 2026. Even so, the report stresses that humans still direct the work.
How to protect yourself and your team
Microsoft’s advice is mostly basic hygiene, and that’s the point. Most of these attacks still need a person to click, reply or hire.
For individuals, the report suggests these steps:
- Share less personal and work detail on social media.
- Ignore or delete unexpected emails and attachments, including those from messaging apps.
- Report suspicious contacts and recruiter-style outreach.
Those steps cut down the material attackers use to build a convincing lure.
For companies, Microsoft recommends checking staffing-agency hires for duplicate personas, shared phone numbers and resume gaps. It also says to verify candidates on camera, and to treat camera or microphone problems as a red flag. For the wider AI-driven scam picture, see our piece on the VOLTA infostealer that grades its victims.
What IT teams should switch on this week
Beyond hiring checks, Microsoft lists several technical steps. None are exotic, but many companies skip them.
On email, it points to Safe Links, Safe Attachments and zero-hour auto purge in Microsoft’s mail tools, plus phishing simulations for staff. It also suggests blocking device code flow where you can. On endpoints, it recommends cloud-delivered protection, real-time protection and attack surface reduction rules.
For web-facing systems, the advice is to put them behind a VPN, WAF or reverse proxy and automate patching. Why this matters: AI makes lures cheaper to produce, so the cheapest defense is making sure one bad click doesn’t open the whole network.
Smaller teams without a security staff can still copy the spirit of this list. Turn on automatic updates, use multi-factor sign-in, and limit who can approve new contractors.
Frequently Asked Questions
Are North Korean hackers using AI to attack on their own?
No. Microsoft says the operations remain human-directed and haven’t become fully autonomous. AI mainly speeds up writing, research and impersonation.
What is a “Sleet” group?
It’s Microsoft’s naming style for North Korean threat actors, such as Jasper Sleet or Onyx Sleet. Each name tracks one cluster of activity.
How can I spot a fake job candidate?
Check for duplicate personas, shared phone numbers and resume inconsistencies. Insist on a live video call, and be wary if the camera or microphone keeps “failing.”
Does this affect regular users, not just companies?
Yes, if you get recruiter-style messages or unexpected attachments. Microsoft advises ignoring them and reporting suspicious contacts.
My take: don’t panic about AI-powered super-hackers. The real risk is a convincing stranger, whether a “recruiter” in your inbox or a “candidate” on your screen. Slow down, verify on a live call, and treat unexpected files as unsafe by default.
Leave a Reply