[Edaily Reporter Yun Junghoon ] A developer whose family fell victim to voice phishing has created technology that uses artificial intelligence (AI) to prevent others from falling victim to the same scam. Kang Hee-do, a manager at the SKTelecom(017670) Integrated Security Center, is the man behind this innovation. He personally developed an AI agent that automatically analyzes malicious applications (apps), thereby transforming the way voice phishing crimes are handled in the field.

According to SKT on the 10th, thanks to the AI agent created by Manager Kang, the task of analyzing malicious apps—which previously required about 19 hours a day—has been automated. From April 15 of this year through September, it also helped approximately 940 SKT customers avoid losses totaling 51.4 billion won.

SKT has been operating this damage prevention system in collaboration with the police since March of this year. Under this system, when the police extract and submit malicious apps from the mobile phones of phishing victims, SKT analyzes the apps to identify C2 (Command and Control) server addresses and shares this information with the three major mobile carriers. The carriers then identify customers who have accessed those addresses and report them to the police.

In the early stages of the collaboration with the police, Manager Kang analyzed the apps one by one on his own. As word spread about the system’s effectiveness in preventing losses, the number of apps requiring analysis grew rapidly. The average number of analyses per day rose by approximately 81%, from 37 in March to 67 in May. Analyzing all 67 cases manually would have required 19 hours per day—a workload that would have necessitated three dedicated specialists. Although outsourcing to an external vendor was considered, the estimated annual cost was projected to exceed 1 billion won.

Manager Kang decided to solve this problem using AI. He designed a multi-agent structure in which multiple Agent AI agents divide roles to autonomously perform the entire process of analyzing the apps’ vast amounts of code. These agents are tasked with identifying the server addresses of criminals hidden within malicious apps. Development using OpenAI Codex took about a month to create a prototype.

The resulting agent, “M-Triple-A,” has been deployed in actual operations since April 15. Previously, Manager Kang analyzed every app himself, but now the AI leads the analysis, while experts review approximately 15% of the total results—such as exceptions or new types. While manually analyzing new types of malware used to take several days, the AI completes the analysis within a few hours. As a result, the time spent by expert staff has been reduced by 96%.

The results are also evident in the numbers. From April 15 to September 30, the agent analyzed approximately 4,300 malicious apps. During this process, approximately 250 C2 server addresses were identified. Based on this information, police were dispatched to the scene, preventing damage to approximately 940 SKT customers and averting losses totaling approximately 51.4 billion won. Considering that this information was shared with the three major telecom carriers and used to prevent further damage, the company estimates that it generated approximately 225 billion won in social value annually.

Manager Kang did not start out in a security role. After earning his Ph.D. from the KAIST Graduate School of Security, he joined SKT as a developer in 2020. He participated in the initial development of “A.dot” and later transferred to the Social Engineering Threat Response Team when it was established in 2023.

“Since a family member had fallen victim to phishing, when the Social Engineering Threat Response Team was formed, I thought I could use my skills to help prevent such incidents,” he said, expressing satisfaction with his work: “It’s very rewarding because I can see firsthand how I’m preventing harm to customers.”

In addition to analyzing malicious apps, Manager Kang is currently involved in developing an agent that automatically classifies spam messages by type—such as gambling, adult content, and illegal medications. The goal is to go beyond simply identifying spam and to refine blocking policies for each specific type.

“Security is an endless battle of cat-and-mouse, where criminals find new ways to evade our defenses,” Manager Kang said. “I will continue to explore technologies that benefit our customers.”