Kimsuky targeted organizations in South Korea and Japan during the first half of 2026 with OneDrive-delivered spearphishing links leading to malicious LNK files. The infection chain established scheduled PowerShell execution, collected system information and Thunderbird, Outlook, and Gmail data, and recorded keystrokes. The actor installed Chrome Remote Desktop and AnyDesk to maintain redundant remote-control access while concealing related windows and icons. ENKI Whitehat linked the campaign to Kimsuky through matching email-theft methods, AnyDesk deployment scripts, regional victimology, and overlap with previously observed tooling and TTPs.