The report
Microsoft's threat-intelligence review describes North Korean operations that used generated text, images or recruiting materials to make social approaches and impersonation more convincing. In these cases, the AI component affects presentation and possible throughput. Account access, social engineering and malware remain separate steps that require their own evidence.
This distinction prevents an ordinary recruiting lure from being counted as a new autonomous attack merely because generated content appeared in it. A persuasive synthetic image is an artifact in an intrusion workflow, not proof that a model performed the intrusion. The recruiting tradecraft dossier describes the relevant role of AI and the attribution conditions documented in Microsoft's October assessment.
Defensive checks should therefore preserve the exact message, account history, domain, attachment behavior and resulting tool activity rather than focusing on whether the prose looks machine-written. The same report also discusses offensive ARTEX tooling, but generated recruiting material and exploitation-stage automation are distinct developments.