Kaspersky says Operation Flashhole has targeted three South Korean software, construction and telecommunications-equipment companies since at least July 2025. Investigators observed deceptive websites, abuse of INISAFE CrossWeb EX and communications protected with ML-KEM-1024. AI generation of website images remains an assessment, and the initial infection route is unconfirmed. Post-quantum encryption protects communications rather than concealing every malicious action on a host. Organizations should scrutinize unexpected email links, update security software and monitor unusual endpoint activity.