BlueNoroff profiles crypto wallets via fake meeting pages, then delivers malware only to high-value targets. JUMPSEC recovered the phishing kit's source code.
North Korea-linked BlueNoroff is running a phishing operation that profiles cryptocurrency users through fake Zoom and Microsoft Teams meetings, then decides which targets get malware.
Cybersecurity firm JUMPSEC recovered source code from an active phishing kit after the operators exposed JavaScript source maps on live infrastructure. The files contained separate Zoom and Teams lures, wallet-scanning tools, operator controls and malware delivery paths for Windows and macOS.
The attack often starts through a Telegram account the target already trusts. Hackers take over accounts belonging to crypto contacts, then send a Calendly invitation that leads to a lookalike meeting domain. JUMPSEC described the system as a repeatable victim pipeline because one stolen Telegram session helps attackers contact the next group of targets.
The phishing page starts scanning the browser when a user enters the fake meeting. It looks for Ethereum wallet connections through EIP-6963 and older browser methods. It also checks for non-EVM wallets, including Solana tools. The results reach an operator panel without alerting the victim. This lets attackers identify wallets and choose higher-value targets before pushing the next stage.
On Windows, the implant also lists extension IDs across Chrome, Edge, Brave, Opera, Vivaldi and Firefox variants. Operators can compare those IDs with known wallet extensions such as MetaMask. JUMPSEC called this a system that profiles wallets “before malware delivery.” The method differs from broad phishing campaigns because attackers gather wallet data before deciding how far to take the intrusion.
Victims first see a convincing meeting page that requests their name and webcam access. The site then sends the camera stream to the attacker’s control panel. After the victim joins, the screen shows “waiting for other participants.” An operator can enter with a prepared video, send messages such as “your mic isn’t working,” and trigger a fake “Zoom SDK Update” prompt.
JUMPSEC found that the displayed participant video was not live. The attackers combined AI-generated headshots with body movements captured in earlier meetings. They could then show a familiar-looking person while using a Telegram account that belonged to a real contact. The Teams version included emoji reactions, device settings, background effects and wider wallet checks, making it more polished than the Zoom kit. The source code also contained an unfinished Google Meet option. JUMPSEC said Zoom and Teams suit the lure because both use desktop clients, making an urgent software update appear more credible.
On Windows, the copied ClickFix command runs a small PowerShell loader. It downloads a VBScript, adds a Microsoft Defender exclusion and restarts Defender so the change takes effect. The implant gathers system details, checks browsers for wallet extensions and looks for Telegram Web files. It can also receive later payloads from the operators, although JUMPSEC did not recover every final-stage file.
The macOS path downloads a fake Zoom or Teams installer while a stealer runs in the background. Researchers found versions that collected system information and Chrome master keys from Apple’s Keychain. The malware sent data through a Telegram bot and could download another payload. JUMPSEC traced four macOS variants between April 22 and July 15, showing that the operators kept changing the toolkit during the campaign.
The findings expand earlier research into BlueNoroff’s fake meeting operations. In April, Arctic Wolf reported more than 80 lookalike Zoom and Teams domains and identified 100 additional targets whose media appeared on attacker infrastructure. It said 80% of the identified targets worked in crypto, blockchain finance or related investment sectors, while founders and chief executives made up 45%.
North Korean attackers had already used compromised Telegram accounts, spoofed meeting invitations and fake software updates to target crypto executives. Another crypto.news report described a related macOS campaign that asked victims to run commands during fake calls. Earlier coverage of NimDoor malware also linked fake Zoom updates to theft attempts against browser credentials, wallet data and Telegram files.
The latest kit gives operators direct control over the pace of each meeting and the malware prompt. JUMPSEC advised organisations to treat meeting links from trusted accounts with care because the sender’s account may already be compromised. Crypto teams can verify unusual invitations through another channel, avoid commands or updates presented during calls, revoke exposed Telegram sessions and isolate any device that ran the requested script. Teams should also review PowerShell activity, Defender exclusions, Keychain access and new Telegram logins after any suspect call. A password reset alone may not remove stolen sessions or malware already running on the device across affected systems.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.