ENKI attributes an active KimJongRAT-related campaign to Kimsuky, with phishing emails impersonating South Korean public institutions such as the Ministry of Gender Equality and Family and the National Tax Service. The infection chain uses PHPMailer-delivered messages, attacker redirects, GitHub Releases ZIP archives, decoy PDFs, malicious LNK files, mshta, Korean URL shorteners, macro-enabled DOC files, obfuscated VBScript, HTA payloads, and Google Drive-hosted follow-on files. Later stages branch on Windows Defender service state, decrypt AES- or RC4-protected payloads, run sys.dll through rundll32, perform anti-VM checks, and download modules including a Chrome App-Bound Encryption master-key extractor and a KimJongRAT-derived infostealer. The infrastructure and artifacts show Kimsuky adapting social-engineering lures, commodity hosting, layered obfuscation, and browser credential-theft capability against South Korean targets.