North Korea's primary espionage group, Kimsuky, has developed an offline artificial intelligence stack to enhance its phishing capabilities and automate malware development. This bespoke AI system, run on the group's own servers, integrates document-search tools with existing files, and aggregates software components necessary for building AI-powered malware. By leveraging this technology, Kimsuky can potentially create more sophisticated and targeted attacks, increasing the risk of successful breaches1. The development of this offline AI stack underscores the group's commitment to advancing its cyber capabilities, posing a significant threat to global cybersecurity. This evolution in Kimsuky's tactics highlights the need for practitioners to reassess their defenses against AI-driven phishing and malware attacks, as the group's new capabilities may render traditional security measures less effective.