Logpresso analyzed four Kimsuky spear-phishing campaigns from early 2026 that used tailored lures against recruiters, business contacts, healthcare and insurance entities, cryptocurrency users and developers, defense-related personnel, and graduate-program stakeholders. The campaigns used LNK files disguised as PDFs or JSE files disguised as HWPX documents, then followed a common flow of lure display, payload drop, persistence, C2 communication, and remote control. Payloads included a PowerShell RAT, a PowerShell infostealer, VBE-to-PowerShell fileless execution, DLL-based reconnaissance, and VS Code tunnel abuse for remote access. The infrastructure mixed attacker-controlled servers with legitimate services such as GitHub raw content, Microsoft CDN delivery, GitHub OAuth, and VS Code tunnels to reduce the effectiveness of reputation-based blocking.