AhnLab reports that Kimsuky compromised the security program installation flow on a Korean construction related association website, causing users who tried to log in to install malware with the required security software. The malicious NX_PRNMAN installer, and earlier TrustPKI variants from December 2023, were packed with VMProtect, signed with a stolen D2Innovation certificate, and placed GoLang malware under %APPDATA% for execution through rundll32.exe. AhnLab says more than 3,000 infections were observed and identifies TrollAgent as an infostealer that collects system data, browser credentials, cookies, bookmarks, history, and extensions. Some installers also deployed GoLang or C++ backdoors with C2 command patterns similar to earlier Kimsuky AppleSeed and fake import declaration campaigns.