North Korean hackers using AI tools stole $12 million in 3 months, showing how AI amplifies even low-skill cybercriminals

A hacking group used AI tools to automate the entire theft pipeline—from writing malware code to generating convincing fake company websites—and stole up to $12 million in a single three-month period. This marks a shift: previously, North Korean hackers were known for sophistication; now mediocre attackers can cause similar damage by outsourcing the technical work to AI.

Instead of manually writing code or designing phishing pages, the group fed prompts into AI systems to generate working malware and fabricated web pages that fooled victims into transferring money. The AI handled the repetitive engineering work, freeing the hackers to focus on social engineering (manipulating people into handing over access).

For anyone in finance, tech, or HR: phishing and fraud attempts are now cheaper and faster to launch at scale. Your employees are targets of AI-generated fake emails and websites that are harder to spot because they don't carry the flaws of hastily-written scams. Security teams need to assume attackers will use AI automation, not just humans with basic skills.