Microsoft said its metadata review of more than 100 PDF files tied to North Korea’s Onyx Sleet pointed to AI use in rapid batches, a pattern it said supported phishing campaigns against South Korean users.
The files were created in August and September 2026, Microsoft said. Metadata showed that some batches contained dozens of documents produced within minutes, leading the company to assess that an AI platform was highly likely involved in those batches. The assessment did not apply automatically to all 100-plus files.
Microsoft said the automation supported high-volume phishing campaigns. A faster supply of tailored documents could make it harder for defenders to disrupt the activity, the company said.
The report assessed AI use by eight North Korean groups. Jade Sleet, Coral Sleet and Jasper Sleet were in Microsoft’s highest tier, where AI is integrated into routine operations. Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet were classified as accelerating their use, while Emerald Sleet was expanding its use.
Microsoft said AI can increase operators’ speed and scale, while supporting goals already pursued by North Korean cyber operations. The report placed those operations among efforts to evade sanctions, generate revenue, gather intelligence or pursue disruptive objectives.
South Korean users were identified as targets, but the report gave no victim-loss figures. Microsoft also did not determine whether AI improved attack success rates or lowered costs. It said AI-enabled operations remain directed by people and have not become fully autonomous.
