Genians describes a Kimsuky spear-phishing campaign that impersonated a South Korean defense-related institution and used generative AI-created military employee ID card imagery as a lure. The campaign connects earlier ClickFix activity targeting North Korea researchers, human rights activists, and journalists with portal-security-themed phishing that led victims to execute PowerShell and batch commands. Reported infrastructure includes liveml.cafe24[.]com, snuopel.cafe24[.]com, jiwooeng.co[.]kr, uws64-116.cafe24[.]com, 183.111.161[.]96, and 51.158.21[.]1, with payload stages involving CAB downloads, AutoIt3.exe masquerading as HncUpdateTray.exe, and a compiled AutoIt config.bin script. The defense-themed case used a malicious LNK inside a ZIP named for a government ID draft, obfuscated cmd and batch logic, scheduled-task persistence disguised as a Hancom update, and periodic C2 polling to support follow-on reconnaissance or remote commands.