AhnLab ASEC reported that the North Korea-linked Kimsuky group was observed exploiting Chrome Remote Desktop alongside its AppleSeed malware and other remote-control tooling. Recent activity used script-type WSF or JS malware, often disguised as document files, to decode and run AppleSeed with regsvr32 arguments such as 123qweASDZXC before installing follow-on tools including infostealers, RDP Patcher, Ngrok, and Chrome Remote Desktop. AppleSeed supports command execution, additional malware installation, keylogging, screenshots, and file theft, while associated infostealers targeted credentials from Chrome, Microsoft Edge, and Naver Whale. The tradecraft shows Kimsuky combining phishing-delivered scripts, backdoors, credential theft, and remote-access utilities to maintain hands-on control of infected systems.