TRANSLATEXT is a malicious Google Chrome extension deployed by Kimsuky in activity observed in March 2024 against South Korean academia. Kimsuky, also known as APT43, Emerald Sleet, and Velvet Chollima, is described as a North Korean government-backed actor focused on cyberespionage and financially motivated attacks, especially against South Korean think tanks, government institutions, and academic organizations. The report places TRANSLATEXT within the group’s established use of malicious Chrome extensions and notes related extension targeting in the United States, Europe, and South Korea. MITRE ATT&CK S1201.