The North Korean nation-state threat actor known as Kimsuky has been linked to a social engineering campaign targeting experts in North Korean affairs with the goal of stealing Google credentials and delivering reconnaissance malware.
“Further, Kimsuky’s objective extends to the theft of subscription credentials from NK News,” cybersecurity firm SentinelOne said in a report shared with The Hacker News.
“To achieve this, the group distributes emails that lure targeted individuals to log in on the malicious website nknews[.]pro, which masquerades as the authentic NK News site. The login form that is presented to the target is designed to capture entered credentials.”
