'The attacker completed in under five minutes': Experts warn of North Korea-linked campaign using fake Zoom meetings to target crypto execs

Date:
Tue, 28 Apr 2026 19:20:00 +0000

Description:
Highly sophisticated scam will leave you questioning what's real while
hackers steal your crypto.

FULL STORY
Security researchers Arctic Wolf have revealed details of a highly sophisticated campaign targeting North American Web3 and cryptocurrency companies.

It is conducted by state-sponsored threat actors called BlueNoroff, a financially motivated subgroup of the dreaded North Korean Lazarus Group,
with a goal of establishing persistent access on their targets devices. They do so by tricking the victim into installing malware on the computers themselves, but the way they do it is quite advanced.

ClicFix has entered the chat -- While preparing for the attack, the
threat actors would use real, high-value people from the Web3 world, generate convincing headshots using ChatGPT, and create semi-animated videos using Adobe Premiere Pro 2021.

They would then create a fake Zoom video call website identical to the actual Zoom call page, and would display the video to make it look even more convincing.

BlueNoroff would then invite the actual victim through Calendly, almost half
a year into the future (most likely to make it look more convincing - important people are, after all, super busy).

When the victim clicks on the Zoom link, they see what theyre used to seeing
- a video call page with the person on the other side moving and acting as if they were real. However, eight seconds into the call, a message would pop up across the screen, saying their SDK is deprecated and presenting them with an Update Now button.

The button leads to a typical ClickFix technique - to fix the problem, the victim needs to copy and paste a command. But since many are now aware of these attacks, BlueNoroff takes it a step further - the code being copied is actually legitimate and benign.

However, the fake Zoom website has a malicious JavaScript application
embedded which handles the copy action, intercepts the clipboard event in the browser, and replaces what the user thinks they copied with different code.

That code, if executed, deploys malware on the device which establishes
remote access to the system, allows BlueNoroff to exfiltrate credentials, session tokens, and other sensitive business data, and grants them the
ability to move laterally throughout the network.

The technical execution chain in this campaign is both efficient and operationally disciplined, Arctic Wolf said. From initial URL click to full system compromise, including C2 establishment, Telegram session theft,
browser credential harvesting, and persistence, the attacker completed in under five minutes.

Link to news story: https://www.techradar.com/pro/security/the-attacker-completed-in-under-five-mi nutes-experts-warn-of-north-korea-linked-campaign-using-fake-zoom-meetings-to- target-crypto-execs

$$
--- MultiMail/DOS
* Origin: Capitol City Hub (1:2320/105)