A Kimsuky-attributed phishing email impersonated South Korea's National Tax Service and Naver electronic document notices to steal Naver account credentials. The lure claimed a September tax filing and payment deadline notice, but the message was sent through Mail.ru infrastructure using schimmel2025@list[.]ru, 95.163.59[.]13, and send174.i.mail[.]ru rather than a Korean government sender. The embedded phishing URL used n-info.bill-nts.server-on[.]net with National Tax Service-themed naming, an encoded redirect toward a Naver-like login flow, and the recipient's Naver address appended for personalization. The activity shows continued Kimsuky use of Korean public-service impersonation and tailored credential-harvesting infrastructure against Korean users.