SentinelLabs observed ongoing Kimsuky campaigns using a new BabyShark-related reconnaissance component named ReconShark against carefully selected individuals and organizations. The activity used tailored spear-phishing emails with OneDrive links to password-protected malicious Word documents, including a campaign against Korea Risk Group and broader targeting of think tanks, research universities, government entities, and organizations in the United States, Europe, and Asia. ReconShark collects process, battery, and endpoint-security information through WMI, exfiltrates it via HTTP POST without writing it to disk first, and stages follow-on VBS, HTA, batch, Office template, DLL, LNK, or curl-based payloads depending on detected defenses. Infrastructure included NameCheap-hosted domains such as yonsei[.]lol, rfa[.]ink, mitmail[.]tech, and newshare[.]online, with links to earlier North Korea-associated credential-phishing infrastructure.