Genians attributes 13 malicious LNK variants collected in August 2026 to Kimsuky’s Operation GitPower, citing matching LNK fingerprints, a shared custom decoder, GitHub PAT-authenticated delivery, and disguised scheduled tasks. The variants execute obfuscated PowerShell, use GitHub Raw Content and Pastebin for payload delivery, and add checks for virtualization and analysis tools. Metadata identifying the opencode AI coding agent, unreviewed placeholders, identical timestamps, and templated HeadlessChrome documents indicate that AI-assisted automation was used to produce lures at scale. The campaign expands its decoys into financial and corporate workflows while retaining the group’s established Git-based C2 architecture.