Spoofed think tank employee email with QR code to Kimsuky infrastructure

FBI FLASH AC-000001-MW "North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities" (08 January 2026)

Also in May 2025, Kimsuky cyber actors spoofing a think tank employee sent an email with a QR code that, when scanned, would take the targeted individual to Kimsuky infrastructure designed to conduct malicious activity.