Researchers found a live Kimsuky-linked phishing and malware-delivery site targeting users in the United States and South Korea. The site hosted a PowerShell script under an xrat path that downloaded an encrypted xeno.bin file, decrypted it, dynamically loaded a .NET Xeno-RAT payload, and configured command-and-control at 152.32.243.152:4444. Additional directories contained PHPMailer-based phishing-mail senders, Naver-themed credential-phishing pages, and request logs that exposed suspected victim IP addresses and captured Kakao/Daum/Hanmail account data. The activity matters for DPRK-focused tracking because it connects Kimsuky infrastructure with Xeno-RAT delivery, Korean webmail credential phishing, and victim telemetry spanning South Korea and the United States.