Breakglass Intelligence maps a large Kimsuky credential-harvesting operation targeting South Korean users through Naver, National Tax Service, NHIS, NongHyup, National Pension Service, and Kakao impersonation themes. The investigation consolidates six infrastructure nodes across providers including Vultr Seoul, Kaopu Cloud HK, UCLOUD HK, Namecheap, and DAOU Technology, with more than 850 phishing hostnames, 65 registered domains, and extensive abuse of dynamic DNS providers. The excerpt describes geofenced Korea-only delivery, browser and bot filtering, compromised SMTP accounts, Telegram bot exfiltration, recovered phishing-kit material, and one confirmed victim with credential and session-cookie capture. It also documents a CHM dropper-to-keylogger chain with exposed C2 directory listing and a shared “Million OK !!!!” server fingerprint, making the report useful for defenders tracking DPRK credential theft infrastructure and active Kimsuky tradecraft.