The source reports a North Korea-attributed phishing site at korean-air.org that impersonated Korean Air with a fake NFT event offering travel benefits to cryptocurrency-wallet users. The lure promised limited free NFT issuance and Japan flight-ticket benefits, then generated a WalletConnect QR code intended to connect and drain the victim's wallet. The article notes the site used a Let's Encrypt certificate, was reachable from Korean IP space at the time, and was not yet detected by several security vendors. The author submitted the domain to Emsisoft, Google Safe Browsing, ESET, and Symantec Site Review for phishing classification.