Deepfake Zoom trap widens crypto risk

BlueNoroff has intensified its campaign against cryptocurrency executives by combining fake Zoom meetings, AI-generated video lures and fileless PowerShell malware in an intrusion that gave attackers access to a North American Web3 company for 66 days.

The operation, first detected after an intrusion began on 23 January 2026, marks a sharper turn in North Korea-linked cyber activity against digital asset businesses. Instead of relying on crude phishing pages or malicious attachments, the attackers used a manipulated Calendly invitation, a typosquatted Zoom link and a realistic browser-based meeting room to persuade the victim to run attacker-supplied commands under the guise of fixing audio problems.

The campaign has been attributed with high confidence to BlueNoroff, a financially motivated subgroup associated with the Lazarus ecosystem and North Korea’s Reconnaissance General Bureau. The group has long focused on banks, cryptocurrency platforms, blockchain developers, venture capital figures and executives with access to wallets, private keys, treasury systems or strategic deal information.

The latest attack chain began with impersonation of a trusted figure in the fintech legal sector. The victim received what appeared to be a legitimate meeting request, with the conferencing link later swapped for a domain that closely resembled Zoom. Once opened, the page displayed a convincing meeting interface, complete with participant tiles, apparent motion and simulated speaker activity.

The meeting was not live. The fake interface used pre-staged media, stolen video and AI-generated imagery to create the appearance of a real call. After the victim granted camera and microphone permissions, the page could capture live footage, adding a self-reinforcing element to the campaign. Video collected from one target could be repurposed to deceive another person in the same professional network.

The malware delivery relied on a ClickFix-style technique, a method in which victims are instructed to copy and paste commands into Windows tools to solve a fabricated technical problem. In this case, the lure centred on a fake Zoom software development kit update. The visible instructions appeared benign, but clipboard manipulation substituted the copied text with a PowerShell command that downloaded and executed the attacker’s payload.

That payload was designed to remain largely memory-resident. The PowerShell chain used obfuscation, execution policy bypasses and hidden processes to reduce visibility. Once active, the implant established command-and-control communications, collected system details, checked for virtual machine indicators and waited for further instructions. Its five-second beaconing pattern allowed the operators to issue tasks quickly while keeping the compromise inside normal user-session activity.

Post-exploitation activity showed clear financial and intelligence-gathering intent. Modules were used to steal Telegram Desktop session data, enumerate installed software, capture screens, extract browser artefacts and attempt privilege escalation. Telegram session theft is particularly significant in the cryptocurrency sector because founders, developers and investors often use messaging platforms for deal discussions, wallet coordination and introductions to new counterparties.

The infrastructure behind the campaign included command servers, exfiltration endpoints and more than 80 typosquatted domains imitating Zoom and Microsoft Teams. Registration patterns from late 2025 through March 2026 point to a prepared campaign rather than a one-off intrusion. Investigators also identified about 100 additional targets, with a heavy concentration in the United States, Singapore and the United Kingdom. A large majority operated in cryptocurrency, and nearly half were founders or chief executives.

BlueNoroff’s methods reflect a wider shift in North Korea-linked cryptocurrency theft. The most damaging attacks increasingly exploit people, communications channels and operational infrastructure rather than smart-contract flaws alone. Centralised exchanges, custodians, foundations and Web3 service providers present high-value targets because a single compromised workstation or messaging account can open access to treasury movements, deployment systems or executive decision-making.

The group’s tactics also show how generative AI is changing social engineering. Synthetic portraits, cloned meeting participants and manipulated video assets reduce the friction involved in impersonation. A victim no longer needs to believe only a text message or email; they can be shown what appears to be a familiar face inside a familiar meeting application.

The defensive implications are immediate for cryptocurrency companies. Meeting links embedded in calendar invitations require scrutiny, especially when a Google Meet invite is changed to a Zoom or Teams URL. Browser requests for camera access on unfamiliar domains should be treated as high risk. Staff should be trained that legitimate conferencing providers do not require users to paste terminal or PowerShell commands to restore audio.