Microsoft says North Korean hackers are using AI to spin up fake companies and poison code

Key points

• Microsoft Threat Intelligence published a report on 29 October 2026 saying North Korean hacking crews are now using AI across their day-to-day operations, from writing fake job lures to tampering with other people's software.
• One group, Jade Sleet, set up three fake front companies in a single week, a pace Microsoft directly ties to AI-assisted work.
• Onyx Sleet used AI to generate dozens of tailored phishing lures, meaning fake emails designed to trick a specific person, in minutes rather than days.
• Onyx Sleet and Pearl Sleet are both using ARTEX, an open-source AI hacking tool that can carry out attack steps on its own.
• The FBI has separately linked Jade Sleet, also known as TraderTraitor, to the theft of more than $6 billion in cryptocurrency.

Microsoft's threat intelligence team has put a number on something security researchers have been muttering about all year: North Korea's state hackers are no longer just experimenting with AI, they're building it into the assembly line.

The company's 29 October report tracks four groups by name. Microsoft gives them weather-themed codenames: Jade Sleet, Onyx Sleet, Coral Sleet, Diamond Sleet, with Pearl Sleet mentioned alongside. These are the crews Western agencies have long tied to Pyongyang's cash-raising and spying operations.

What's new is the tempo.

What are the North Koreans actually doing with AI?

They're using it to do the slow parts of hacking faster. Microsoft says Jade Sleet launched campaigns through three fake front companies in one week. Onyx Sleet produced dozens of custom phishing messages, tailored to individual targets, in minutes. Coral Sleet built a new tool to secretly plant malicious code inside private software projects, what the industry calls trojanizing a repository.

Diamond Sleet is using AI for what Microsoft calls persona development: inventing convincing fake people, with fake employers, to approach targets on professional networks. If you've ever been messaged by a recruiter who seemed just slightly off, this is the industrial version of that.

None of these tasks are new. Fake recruiters, poisoned code, shell companies: North Korean staples for years. The AI is a force multiplier, to use Microsoft's phrase, not a new weapon.

Which groups are named, and what are they known for?

Jade Sleet is the one most readers will have heard of without knowing the name. The FBI, IRS Criminal Investigation and the Secret Service have attributed more than $6 billion in stolen cryptocurrency to this crew, as first reported by The Hacker News. That theft funds a sanctioned regime, which is the whole point of the operation.

Should ordinary people worry about this?

Mostly indirectly. You're not the target. Software developers, crypto exchange staff and defence contractors are, along with the recruiters who talk to them.

But the knock-on effects reach everyone. If Coral Sleet successfully plants malicious code inside a widely used software project, the eventual victims are whoever installs the updated software months later. That's the supply-chain risk that made the SolarWinds break-in so painful in 2020, and AI makes it cheaper to try more often.

For individuals, the practical advice is boring and unchanged. Treat unsolicited recruiter messages with suspicion, especially ones that want you to run a coding test or install a wallet app. Verify the company through a channel the recruiter didn't give you.

My read: the interesting line in Microsoft's writeup is the one about ARTEX, an open-source agentic penetration testing framework, meaning a hacking tool that can plan and act on its own. We first covered ARTEX on 21 October 2026, when Storm-0940 used it to move from first contact to privileged cloud access in under three hours. State crews adopting public agent frameworks is the trend to watch next year, not the lure-writing. Writing a convincing phishing email was never the hard part.