ENKI Whitehat reported Kimsuky malware delivery cases targeting South Korean military and corporate environments through April 2026. The actor used fake security software installation pages and a Webex-themed lure based on a legitimate meeting schedule, while distribution pages used JSONPing to query localhost services created by malware and verify victim execution. The Webex chain delivered a new HttpSpy variant through installer, loader, and in-memory main module stages, with persistence under a Run key and C2 over encrypted HTTP POST. ENKI linked the activity to Kimsuky through shared RC4 keys, infrastructure overlaps, code patterns, export names, default XAMPP certificate reuse, and artifacts associated with prior HttpSpy, HttpTroy, and HelloDoor-related activity.