In 2026, a systems engineer at Aerial Intelligent Mechanical Leaders (AIML) accepted a LinkedIn connection from "Andy," a fellow engineer at a defense think tank, who shared "internal" white papers and invited him to a "secure" portal. Andy was actually an agentic large language model (LLM) operated by a foreign nation-state, designed to deliver a single, mutating piece of malware capable of slipping past AIML's signature-based detection systems. This scenario reflects tactics used by the Lazarus Group, North Korean state-sponsored actors, who used fake recruiter personas on LinkedIn to target defense contractors, building rapport over weeks and sending malware-laced "white papers." A 2025 CrowdStrike Threat Hunting Report noted a 220% year-over-year increase in infiltrations. Groups like Famous Chollima have infiltrated more than 320 companies using GenAI to build fake personas for "deepfake" interviews, securing remote work positions to receive hardware packages that are then shipped to adversaries, enabling network infiltration and information exfiltration.