Genians links early 2025 ClickFix activity to Kimsuky and assesses it as an extension of the group's BabyShark campaign. The activity targeted South Korean experts in diplomacy, national security, and international politics through sustained spear-phishing, including impersonation of journalists and an aide to a senior U.S. national security official. One infection chain delivered an encrypted archive containing a malicious VBS file that opened a decoy document, downloaded from konamo.xyz, established persistence with a scheduled task, collected process and user details, and contacted a BabyShark-pattern C2 endpoint. A later variant replaced the VBS delivery with a ClickFix-style secure-document lure that instructed users to copy and paste an authentication code into PowerShell, using reverse-order obfuscation to hide the executed command. The report shows Kimsuky adapting public ClickFix tradecraft into targeted social-engineering operations against South Korean policy-focused targets.