How Is Kimsuky Using AI In Cyberattacks? The tools also support retrieval-augmented generation, which allows language models to reference collections of stored documents while answering queries. Kimsuky has also collected software libraries used to embed language models into custom applications, alongside the Cursor AI coding assistant and speech-to-text tools. Genians said the activity appears focused on incorporating existing open-source AI models into malware development, data analysis and attack automation rather than building proprietary AI models from scratch. That matters because phishing attacks often rely on small errors that expose fraudulent emails or documents.