BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

North Korean threat actors, identified as BlueNoroff, have been found operating a highly sophisticated and actively developed phishing kit. This advanced platform leverages typosquatted Zoom and Microsoft Teams domains, combined with elaborate social engineering tactics and even AI-generated deepfakes, to deliver malware to high-value targets within the cryptocurrency sector. The revelation, detailed in an in-depth report by cybersecurity firm JUMPSEC, underscores a significant escalation in the state-sponsored group’s efforts to illicitly acquire funds through cybercrime, highlighting a meticulously crafted victim acquisition pipeline.

The campaign, described by JUMPSEC as an "operator-driven victim acquisition platform," represents a concerning evolution in cyber warfare, where trust abuse is operationalized. BlueNoroff meticulously combines compromised industry contacts, advanced social engineering, cryptocurrency wallet reconnaissance, and tailored malware delivery to create a repeatable and highly effective attack chain. A critical distinguishing feature of this operation is its initial profiling of victims’ cryptocurrency wallets, allowing the threat actors to selectively target individuals with substantial digital assets, maximizing their potential returns.

Unmasking BlueNoroff: A Persistent Threat

BlueNoroff is widely recognized as a sub-group of the notorious Lazarus Group (also known as APT38, Hidden Cobra, or Kimsuky), a state-sponsored cyber espionage and cybercrime collective linked to the Democratic People’s Republic of Korea (DPRK). Unlike some Lazarus sub-groups focused purely on espionage, BlueNoroff primarily targets financial institutions and cryptocurrency exchanges globally, with a clear mandate to generate revenue for the North Korean regime, circumventing international sanctions. Their activities often involve sophisticated social engineering, custom malware, and long-term infiltration strategies.

The "ClickFix-style campaigns" referenced in the report are a hallmark of BlueNoroff’s tactics. This methodology involves tricking unsuspecting targets into executing malicious commands, often under the guise of resolving technical issues, such as camera or audio malfunctions, or prompting essential software updates for videoconferencing platforms. This approach exploits the victim’s immediate need to participate in a meeting, reducing their vigilance and increasing the likelihood of compliance with seemingly innocuous instructions.

The ongoing nature and evolution of these campaigns have been thoroughly documented by various cybersecurity researchers since early 2025. Sekoia, another prominent cybersecurity firm, has been tracking a related North Korea-aligned threat cluster under the moniker "ClickFake Interview." This cluster employs similar ClickFix-like lures, often framed as interview preparation or technical checks, to deceive targets into running malicious scripts. Reports from June and October 2025 detailed "BlueNoroff deepfake Zoom scams" and exposed "Ghostcall" activities, respectively, further illustrating the group’s consistent focus on this attack vector. More recently, in April 2026, social engineering tactics attributed to UNC1069, another associated group, targeted Axios, demonstrating a broad and adaptive targeting strategy.

The Deceptive Onset: Compromised Trust and Self-Propagation

The initial phase of BlueNoroff’s attack chain hinges on compromising established trust. Attackers hijack legitimate Telegram accounts belonging to individuals within the cryptocurrency space – often contacts the target already trusts and may have even met in person. This critical first step bypasses many initial security filters and heightens the perceived legitimacy of the communication. From these compromised accounts, high-ranking employees of major companies are messaged, typically with a Calendly meeting link. Calendly, a legitimate scheduling tool, adds another layer of authenticity to the initial interaction.

The campaign exhibits a disturbing self-sustaining nature. JUMPSEC’s analysis revealed that "Every victim who runs the payload with Telegram Web open or Telegram Desktop installed is a candidate for their Telegram session to be stolen and reused against their own contacts." This means a single successful compromise can lead to a cascade of further infections, allowing BlueNoroff to expand its network of compromised accounts exponentially within interconnected professional circles. This method is exceptionally efficient, as each account takeover fuels the next stage of the attack, making detection and containment significantly more challenging.

Upon clicking the Calendly link, victims are redirected to what appears to be a legitimate Zoom meeting URL. However, this URL is, in reality, a meticulously crafted typosquatted domain, designed to impersonate the genuine videoconferencing service. These fake domains are often subtly different, leveraging common misspellings or adding extra subdomains (e.g., "us.zoom.06webin.us" instead of "us02web.zoom.us") to evade immediate suspicion.

The Illusion of Interaction: Deepfakes and Data Exfiltration

Once on the phishing page, users are prompted to enter their name and grant permissions to access their webcam – a seemingly standard request for any video call. This seemingly innocuous step, however, triggers the stealthy exfiltration of the webcam stream directly to the operators’ command-and-control panel via mediasoup WebRTC. Mediasoup is a legitimate WebRTC server-side library, but in this context, it is weaponized to silently monitor and record the victim without their knowledge.

Following this initial data capture, victims are led to another page, giving the impression that they have joined a Zoom call, but are "waiting for other participants." This holding pattern is strategically designed to maintain the illusion of a legitimate meeting while the attackers execute the next phase of their sophisticated plan.

Simultaneously, the phishing kit performs a detailed fingerprinting of the victim’s web browser to identify and inventory any installed cryptocurrency wallets. This reconnaissance step is crucial for BlueNoroff, as it allows them to confirm the target’s value before proceeding with malware delivery, ensuring their efforts are focused on high-yield individuals.

The "admin" then ostensibly joins the fake meeting. Here lies one of the most advanced elements of the campaign: the video feed the victim sees is not a live stream of a genuine participant. Instead, it is a pre-edited video featuring AI-generated headshots, crafted using tools like OpenAI ChatGPT, superimposed over authentic body movements captured during previous successful meetings. JUMPSEC elaborated on this, stating, "So, each successful attack feeds source material into the composites used against the next target. This combined with the Telegram account takeover method means that the fake meeting shows a plausibly familiar-looking face, moving with the body language of someone who was actually captured on camera." This innovative use of deepfake technology creates an extremely convincing illusion, making it incredibly difficult for victims to discern the deception, especially when the "person" on screen appears familiar.

Once the victim is thoroughly engaged in this fabricated environment, the operator utilizes their control panel to manipulate the meeting. They can send fake messages, such as "your mic isn’t working," further pressuring the victim to take action. This culminates in the critical prompt for a "Zoom SDK Update," which, when executed, delivers the final ClickFix payload – the malware designed to steal cryptocurrency or other sensitive information.

Campaign Refinements and Operator Tracing

JUMPSEC’s investigation uncovered two distinct lure variants, one for Zoom and another for Microsoft Teams. The Teams variant exhibited a higher degree of polish, incorporating features such as emoji reactions, mobile/tablet blocking, and more advanced wallet probes prior to malware delivery, indicating BlueNoroff’s continuous efforts to refine their tools and expand their target base. Both ClickFix attack chains are compatible with widely used operating systems, Windows and macOS, maximizing their potential reach.

Further forensic analysis led to the identification of an operator associated with the campaign. The Telegram exfiltration function within the stealer binary hard-codes the bot token and chat ID. Querying the Telegram API with this bot token linked it to an individual operating under the name "John" (@alchemy_john_mac). This "John" was observed as recently as May 2026, actively engaging with admins of the MAIV cryptocurrency group, inquiring about vesting contracts and fund withdrawals, further cementing the link to cryptocurrency theft.

An examination of the threat actor’s infrastructure revealed a relentless development cycle. Between May 31 and July 14, 2026, five distinct versions of the phishing kit were discovered, signifying continuous active development, testing, and fine-tuning efforts by BlueNoroff to enhance their attack capabilities and evasion techniques. This rapid iteration highlights the group’s dedication and resources.

Strategic Platform Choice: Why Zoom and Teams?

Sean Moran, Head of Threat Research and Enablement at JUMPSEC, provided crucial insights into BlueNoroff’s specific focus on Zoom and Microsoft Teams, eschewing platforms like Google Meet. He outlined three primary reasons:

1. ClickFix Pretext Compatibility: The core of the ClickFix lure relies on prompting users to update their software. This tactic is highly effective for platforms like Zoom and Teams, which are known for their heavyweight desktop clients and frequent updates. Google Meet, being primarily browser-based, lacks this vulnerability to the "SDK update" pretext, making the social engineering less credible.
2. Target-Application Fit: Zoom and Teams are prevalent communication platforms within the financial world, particularly among cryptocurrency investors, venture capitalists, and founders for "investor/partnership calls." Google Meet, while popular, is often perceived as more of a general customer calling platform rather than the preferred tool for high-stakes financial discussions, making targets less likely to be using it for sensitive interactions.
3. Typosquatting Surface: The domain schemes for Zoom and Teams, often involving multiple sub-domains (e.g., "us.zoom.06webin.us"), offer a fertile ground for typosquatting and sophisticated spoofing. In contrast, "meet.google.com" is a simpler, more direct domain, making it harder to convincingly typosquat or create deceptive look-alike URLs that would fool discerning users.

Moran also noted that while the current phishing kit focuses solely on Zoom and Teams, the source code contains an unimplemented stub for a Google Meet equivalent. This suggests that while BlueNoroff has the technical capability to target Google Meet, their strategic decision to prioritize Zoom and Teams is driven by the factors outlined above, coupled with the proven effectiveness of their current setup.

Broader Implications and Cybersecurity Posture

The sophisticated nature of BlueNoroff’s latest campaign carries significant implications that extend far beyond the immediate threat. As the Web3 ecosystem and digital assets continue their rapid maturation, threat actors are increasingly recognizing that compromising the individuals who control access to these assets can be as lucrative, if not more so, than directly attacking the underlying infrastructure. This shift necessitates a re-evaluation of security paradigms.

JUMPSEC concludes that BlueNoroff’s relentless refinement of their attack methods serves as a stark reminder that organizations must adopt a holistic approach to security. This means treating identity, relationships, and communication channels as critical components of their overall security posture, rather than isolated elements.

To mitigate such advanced threats, organizations and individuals, particularly those in the cryptocurrency and financial sectors, must implement robust cybersecurity measures. These include:

• Enhanced Employee Training: Comprehensive and regular training on identifying sophisticated phishing attempts, deepfake technology, and social engineering tactics is paramount. Employees must be educated on the subtle cues of deception, even when communications appear to come from trusted contacts.
• Multi-Factor Authentication (MFA): Implementing strong MFA for all accounts, especially on communication platforms like Telegram, Zoom, and Microsoft Teams, can significantly reduce the risk of account takeover, even if credentials are compromised.
• Vigilance with Software Updates and Permissions: Users should be highly suspicious of unsolicited requests for software updates or unusual permission grants, particularly during a live meeting. All updates should be initiated directly from official application sources, not through external links.
• Verification Protocols: Always verify meeting links and sender identities through alternative, secure channels (e.g., a phone call to the known contact) before clicking any links or downloading files.
• Robust Endpoint Security: Deploying advanced endpoint detection and response (EDR) solutions can help detect and block malicious payloads, even those disguised as legitimate software updates.
• Threat Intelligence Sharing: Active participation in threat intelligence sharing communities can help organizations stay abreast of the latest tactics, techniques, and procedures (TTPs) employed by state-sponsored groups like BlueNoroff.

BlueNoroff’s current campaign exemplifies the evolving sophistication of state-sponsored cybercrime. By weaponizing trust, leveraging cutting-edge deepfake technology, and meticulously targeting high-value individuals, these actors pose an enduring and significant threat to the global financial landscape. A proactive, multi-layered security strategy is no longer optional but essential for safeguarding digital assets and sensitive information in this increasingly complex cyber environment.