North Korean BlueNoroff Threat Actors Unmask Advanced Phishing Kit Exploiting Zoom and Microsoft Teams with AI Deepfakes and Crypto Wallet Profiling

A sophisticated and actively developed phishing kit, operated by North Korean threat actors known as BlueNoroff, has been identified employing typosquatted domains mimicking popular videoconferencing platforms like Zoom and Microsoft Teams. This advanced social engineering campaign, dubbed "ClickFix-style," is designed to deliver malware, profiling victims’ cryptocurrency wallets, and leveraging AI-generated deepfakes to enhance its deceptive capabilities. The findings, detailed in a comprehensive report by cybersecurity firm JUMPSEC, highlight an alarming evolution in state-sponsored cybercrime, where trust abuse, identity theft, and cutting-edge technology converge to target high-value individuals, particularly within the cryptocurrency and financial sectors.

The Genesis of the ClickFix Campaign: BlueNoroff’s Evolving Modus Operandi

BlueNoroff, a financially motivated subgroup of the notorious Lazarus Group (also known as APT38), has a well-documented history of targeting financial institutions and cryptocurrency exchanges globally to generate illicit revenue for the Democratic People’s Republic of Korea (DPRK). Their operational methodology often involves highly targeted social engineering schemes, meticulously crafted to ensnare unsuspecting victims. The "ClickFix-style campaigns" represent a significant refinement of this approach, building on earlier iterations documented since early 2025.

Initial observations of this threat activity were shared by researchers who exposed the "GhostCall" and "ClickFake Interview" campaigns, with Sekoia tracking a related North Korea-aligned cluster under the "ClickFake Interview" moniker. These earlier campaigns similarly leveraged ClickFix-like lures, often exploiting perceived technical issues such as camera or audio problems, to trick targets into executing malicious commands. The current evolution, as described by JUMPSEC, operationalizes trust abuse into a highly repeatable victim acquisition pipeline. This pipeline uniquely combines compromised industry contacts, sophisticated social engineering tactics, meticulous cryptocurrency wallet reconnaissance, and multi-platform malware delivery, allowing for the selective targeting of individuals with significant digital assets.

Anatomy of a Sophisticated Phishing Attack: A Multi-Stage Deception

The campaign commences with a meticulously orchestrated initial access vector: the exploitation of compromised trusted contacts. Attackers hijack legitimate Telegram accounts belonging to individuals within the cryptocurrency space. This initial breach allows BlueNoroff to message high-ranking employees of major companies, leveraging pre-existing relationships and trust to distribute malicious links. The choice of Telegram as a propagation vector is strategic, given its widespread use within the crypto community and its capacity for rapid, seemingly personal communication.

Victims receive a message containing a Calendly meeting link. Calendly, a legitimate scheduling tool, adds a layer of authenticity to the initial interaction, making the request appear professional and routine. However, clicking this link redirects the victim not to a genuine Calendly page or a legitimate videoconferencing platform, but to a carefully crafted, typosquatted domain designed to impersonate Zoom or Microsoft Teams. These fake domains are often subtly altered, for example, using variations like "us.zoom.06webin.us," making them deceptively similar to authentic URLs and easy for a hurried user to overlook the discrepancy.

Upon landing on the phishing page, victims are prompted to enter their name and, critically, grant permissions for webcam access. This is a pivotal moment in the attack chain. Once these permissions are provided, the victim’s webcam stream is stealthily intercepted and relayed to the operators’ command-and-control panel. This is achieved through the use of mediasoup WebRTC, a legitimate open-source WebRTC server that the attackers have co-opted for their nefarious purposes. The ability to covertly access and stream live video of the victim represents a significant privacy breach and a powerful tool for reconnaissance and future manipulation.

The AI Deepfake Deception: Blurring the Lines of Reality

One of the most innovative and disturbing aspects of this campaign is the integration of AI-generated deepfakes. After the victim grants webcam permissions and seemingly joins the meeting, they are presented with another page displaying what appears to be a Zoom call, but with only themselves visible, accompanied by the message "waiting for other participants." This stage sets the groundwork for the deeper deception.

Once the "admin" (the BlueNoroff operator) joins the fake meeting, the victim is presented with a video feed. However, this isn’t a live stream of the attacker. Instead, it’s a pre-edited video composite featuring AI-generated headshots created using tools like OpenAI ChatGPT. These AI-generated faces are then superimposed over authentic body movements that were captured during previous, successful attacks. This ingenious technique means that each successful attack effectively feeds source material into the composites used against the next target.

This combination of hijacked Telegram accounts (ensuring the initial contact is from a trusted source) and AI-generated deepfakes (presenting a plausibly familiar-looking face with natural body language) creates an incredibly convincing illusion. The victim believes they are interacting with a known contact, or at least a credible professional, adding immense psychological pressure to comply with subsequent requests. The sophistication of this deception underscores the increasing maturity of cyber threat actors in leveraging advanced technologies for social engineering.

From Deception to Payload: The ClickFix Malware Delivery

With the victim fully immersed in the fake meeting scenario, the BlueNoroff operator takes control using their custom panel. This panel allows them to manipulate the meeting environment, sending fabricated messages like "your mic isn’t working" or "your camera is not connected." These messages are designed to create a sense of urgency and technical malfunction, paving the way for the final stage of the attack: malware delivery.

The operator then triggers a fake "Zoom SDK Update" prompt. Believing they are addressing a genuine technical issue within a legitimate videoconferencing platform, the victim is lured into downloading and executing what they perceive to be an essential software update. In reality, this "update" is the ClickFix payload. This malware, compatible with both Windows and macOS operating systems, grants the attackers remote access, facilitates data exfiltration, and can further compromise the victim’s system and network. The specific functionalities of the ClickFix payload can vary but typically involve persistent access, credential harvesting, and additional reconnaissance capabilities.

Simultaneously with the meeting manipulation, the phishing kit executes a crucial fingerprinting step on the victim’s web browser. This process inventories all installed cryptocurrency wallets, allowing the attackers to identify high-value targets based on their digital asset holdings. This selective targeting ensures that the significant resources invested in each attack are directed towards individuals who can yield the highest financial returns, aligning perfectly with BlueNoroff’s state-sponsored financial objectives.

The Operators and Their Evolving Arsenal

Further investigation by JUMPSEC into the campaign’s infrastructure and operational security revealed intriguing details about the threat actors. The Telegram exfiltration function within the stealer binary was found to hard-code the bot token and chat ID. Querying the Telegram API using this bot token led researchers to identify an operator going by the name "John" (@alchemy_john_mac). This individual was observed as recently as May 2026, engaging with admins of the MAIV cryptocurrency group, inquiring about vesting contracts and fund withdrawals, indicating active involvement in the cryptocurrency ecosystem and direct financial motivation.

An extensive examination of the threat actor’s infrastructure has also unveiled rapid development and refinement of the phishing kit. Researchers discovered five distinct versions of the kit deployed between May 31 and July 14, 2026. This aggressive development cycle underscores BlueNoroff’s commitment to improving their tools, adapting to new defenses, and enhancing the efficacy of their social engineering tactics. Each new version likely incorporates lessons learned from previous attacks, adds new features, or attempts to evade detection, making it a dynamic and persistent threat.

Strategic Targeting: Why Zoom and Teams Over Google Meet?

A notable aspect of BlueNoroff’s campaign is its specific focus on impersonating Zoom and Microsoft Teams, while seemingly overlooking other popular platforms like Google Meet. Sean Moran, head of threat research and enablement at JUMPSEC, provided critical insights into this strategic choice, attributing it to three primary factors: pretext compatibility, target-application fit, and typosquatting surface.

Firstly, the core lure of an "SDK out of date" is highly effective for platforms that victims perceive as having a "heavyweight desktop client," such as Zoom and Teams. Google Meet, being primarily a browser-first application, does not typically require a desktop SDK update, making the pretext less believable for its users.

Secondly, Zoom and Teams are often the default communication platforms for professionals in the crypto, venture capitalist, and finance worlds. These sectors are precisely where BlueNoroff’s high-value targets reside. Google Meet, in contrast, is more commonly associated with customer service or internal company calls, rather than high-stakes investor or partnership discussions that would involve individuals with significant cryptocurrency holdings.

Lastly, the typosquatting surface plays a crucial role. The complex subdomain structures often seen in legitimate Zoom links, such as "us.zoom.06webin.us" (as cited in the original report), provide ample opportunities for subtle spoofing that can easily deceive users. In contrast, "meet.google.com" has a simpler, more direct domain structure, making it harder to typosquat convincingly without obvious alterations.

Despite these strategic reasons, Moran also revealed that the phishing kit’s source code contains an unimplemented stub for a Google Meet equivalent. This suggests that while the current focus is deliberate and effective, BlueNoroff has considered expanding to Google Meet, possibly as a future development if their current tactics become less potent or if target demographics shift. For now, the existing setup is proving highly successful, obviating the immediate need for diversification.

Broader Implications and Cybersecurity Outlook

The BlueNoroff campaign represents a significant escalation in state-sponsored cyber warfare and financially motivated cybercrime. Its implications extend far beyond the immediate targets, touching upon the fundamental principles of digital trust and security.

Threat to Web3 and Digital Assets: As Web3 technologies and digital assets continue their rapid maturation, threat actors are increasingly recognizing the immense value in compromising individuals who control access to these assets, rather than solely attacking the underlying infrastructure. This shift in focus underscores the need for robust security practices not just for blockchain protocols and exchanges, but also for the human element interacting with them. The targeted nature of this campaign, focusing on cryptocurrency wallet holders, highlights the persistent threat to this burgeoning sector.

Evolving Social Engineering with AI: The integration of AI-generated deepfakes demonstrates a concerning trend where advanced artificial intelligence is weaponized to create highly convincing and emotionally manipulative social engineering schemes. This blurs the lines between reality and deception, making it increasingly difficult for individuals to discern legitimate interactions from malicious ones. Organizations and individuals must adapt their threat models to account for AI-enhanced deception.

Supply Chain Risk and Trust Erosion: The exploitation of compromised trusted contacts via platforms like Telegram creates a self-propagating attack chain. A single compromised account can become a vector for subsequent attacks, turning victims into unwitting facilitators of further breaches. This highlights the inherent vulnerabilities within interconnected professional networks and the critical importance of verifying identities and communications, even from seemingly trusted sources. The erosion of trust in digital communications poses a significant challenge for global commerce and collaboration.

Organizational Security Posture: JUMPSEC’s conclusion emphasizes that organizations must broaden their understanding of security. Beyond traditional technical defenses, "identity, relationships, and communication channels" must be considered critical components of an organization’s security posture. This necessitates comprehensive employee training on social engineering tactics, robust multi-factor authentication across all platforms, strict access controls, and protocols for verifying suspicious requests, even if they appear to originate from within trusted networks.

State-Sponsored Cybercrime Funding: The continuous refinement and aggressive deployment of such sophisticated tools by BlueNoroff reinforce the reality that North Korea heavily relies on cybercrime to circumvent international sanctions and fund its illicit weapons programs. The financial success of these operations directly contributes to geopolitical instability, making the fight against these threat actors a matter of international security.

Mitigation and Expert Recommendations

In light of these advanced threats, cybersecurity experts universally recommend several proactive measures for individuals and organizations:

1. Verify, Verify, Verify: Always scrutinize URLs for subtle typos or irregularities before clicking. If a link seems suspicious, even from a trusted contact, verify its authenticity through an alternative communication channel (e.g., a phone call).
2. Multi-Factor Authentication (MFA): Implement strong MFA on all accounts, especially for communication platforms like Telegram and financial services, to prevent unauthorized access even if credentials are stolen.
3. Be Wary of Unexpected Updates: Never download software updates from unverified sources. Always go directly to the official website of the software vendor to download updates.
4. Employee Training: Conduct regular, comprehensive cybersecurity awareness training for all employees, focusing on recognizing social engineering tactics, phishing attempts, and the dangers of AI-generated content.
5. Separate Devices for Digital Assets: Consider using dedicated, air-gapped devices for managing significant cryptocurrency holdings to minimize exposure to malware from general browsing or communication.
6. Report Suspicious Activity: Promptly report any suspicious emails, messages, or activities to IT security teams or relevant authorities.

The BlueNoroff campaign serves as a stark reminder of the ever-evolving threat landscape and the critical need for vigilance, adaptive security strategies, and international cooperation to counter sophisticated state-sponsored cyber threats. As AI becomes more accessible, the challenge of discerning truth from highly crafted deception will only intensify, demanding a fundamental shift in how digital interactions are approached and secured.