AhnLab observed multiple LNK- and HWP-based spear-phishing chains targeting organizations in South Korea during August 2026. The chains used PowerShell, AutoIt, scheduled tasks, GitHub-hosted payloads, PubNub communications, DLL side-loading, Python backdoors, and XenoRAT-type malware to steal information or establish remote access. AhnLab tagged the page for Kimsuky, but the report's narrative does not directly assign any individual attack chain or indicator to that actor.