Zscaler observed Kimsuky using a malicious Chrome extension named TRANSLATEXT for espionage against South Korean academia, especially researchers focused on North Korean political affairs. The campaign involved an archive lure translated as a review of a monograph on Korean military history, containing HWP decoys and a Windows executable that retrieved PowerShell from actor-controlled infrastructure. A related PowerShell script checked Chrome’s ExtensionInstallForcelist registry policy, suggesting the actor forced installation of the extension through earlier-stage tooling. TRANSLATEXT masqueraded as Google Translate, was briefly hosted in an attacker-controlled GitHub repository as GoogleTranslate.crx, and included JavaScript to bypass Gmail, Naver, and Kakao security prompts, steal email addresses, passwords, cookies, and capture browser screenshots. The short-lived GitHub upload and deletion window indicates an attempt to limit exposure while targeting selected victims.