A North Korea-linked crew is using fake Zoom and Microsoft Teams meetings to do more than steal logins. It is quietly checking whether a target has crypto wallets installed before deciding how hard to hit.
- JUMPSEC linked the phishing kit to BlueNoroff based on live infrastructure and source code.
- The kit profiles wallets before malware delivery, scanning browsers for crypto tooling.
- Compromised Telegram accounts and fake Calendly invites help the lure look legitimate.
- Windows and macOS infection chains differ, but both feed the same scam.
JUMPSEC says the campaign fits BlueNoroff, a North Korea-linked hacking group with a long track record of targeting crypto firms, executives, and anyone else who might hold useful access. The main point is not just that the attackers are phishing. They profile the victim first, then decide whether to drop malware. That is a lot more disciplined than the usual spam-and-pray garbage.
The researchers said they recovered and analyzed source code from an active phishing kit exposed on live infrastructure. The files included separate Zoom and Teams lures, wallet-scanning tools, operator controls, and malware delivery paths for both Windows and macOS. JUMPSEC also found the operators had exposed JavaScript source maps, developer files that can reveal the structure of the code behind a live page.
The attack chain starts with trust. The victim is approached through a Telegram account they already recognize, often one belonging to a real crypto contact that has been hijacked. From there, the target receives a Calendly invitation that leads to a lookalike meeting domain. The goal is simple. Make the fake meeting feel ordinary enough that the target stops asking questions.
Once the victim opens the page, the kit starts checking for crypto signals in the browser. JUMPSEC said the page looks for Ethereum wallet connections using EIP-6963, a newer browser standard that lets sites detect connected wallets, as well as older wallet discovery methods. It also checks for non-EVM wallets, including tools tied to Solana. On Windows, the implant enumerates extension IDs across Chrome, Edge, Brave, Opera, Vivaldi, and Firefox variants, then compares those IDs with known wallet extensions such as MetaMask.
That is the part worth underlining. The kit is not just waiting for someone to bite. It checks whether the victim looks like a worthwhile crypto target before the heavier payload arrives. JUMPSEC described that as profiling wallets “before malware delivery” and called the setup a “repeatable victim pipeline.”
The fake meeting page itself is built to feel annoyingly believable. The victim is asked for a name and webcam access. JUMPSEC said the site forwards the camera stream to the attacker’s control panel, then shows the familiar “waiting for other participants” screen while the operator gets ready. From there, an operator can enter using a prepared video and send messages like “your mic isn’t working, ” before triggering a fake “Zoom SDK Update” prompt.
JUMPSEC said the participant video shown to the victim was not live. The researchers also noted that the operators combined stolen footage with AI-generated imagery to make the setup more convincing. It is the digital version of a con artist wearing a borrowed suit and a fake mustache while telling you your software urgently needs “one quick update.”
The choice of Zoom and Teams is not random. Both are desktop-heavy tools, so a prompt claiming that the client needs updating can feel plausible during a meeting. That matters because the scam leans on habit and pressure. If someone thinks they are late for a call, they are more likely to click through a fake prompt they would normally reject in a heartbeat.
The Windows path leans on ClickFix, a social-engineering trick that pushes the victim to run commands themselves. In this case, a small PowerShell loader downloads a VBScript, adds a Microsoft Defender exclusion, and restarts Defender so the change takes effect. After that, the implant gathers system details, checks browsers for wallet extensions, looks for Telegram Web files, and can receive later payloads from the operators.
JUMPSEC said it did not recover every final-stage file, so not every downstream capability is visible. Even so, the parts that were recovered show a clear pattern: weaken the machine first, then expand access once the target has been softened up. That is a tidy little scam factory, and not in a good way.
The macOS chain follows a different route. In that version, the victim downloads a fake Zoom or Teams installer while a stealer runs in the background. JUMPSEC found versions that collected system information and Chrome master keys from Apple’s Keychain, which can help decrypt stored browser data or session information on macOS. The stolen data was sent through a Telegram bot, and the malware could also pull down another payload later.
JUMPSEC traced four macOS variants between April 22 and July 15, which suggests the operators were iterating rather than sticking to one static lure. The source code also contained an unfinished Google Meet option, though JUMPSEC said that type exists but was not implemented in this build.
Earlier reporting adds useful scale to the picture. In April, Arctic Wolf reported more than 80 lookalike Zoom and Teams domains and about 100 additional targets whose media appeared on attacker infrastructure. According to Arctic Wolf, 80% of the identified targets worked in crypto, blockchain finance or related investment sectors, and founders and chief executives made up 45% of the set.
That target mix tells you exactly what the attackers care about: access. Crypto founders, executives, traders, and operators often have browser wallets, Telegram access, exchange credentials, signing authority, or a direct route to someone who does. If you are a North Korea-linked crew trying to steal value, those are the people worth stalking. Random retail users are just background noise.
This playbook also fits a broader pattern seen in North Korea-linked operations: compromised Telegram accounts, spoofed meeting invitations, fake software updates, and malware tuned for browser credentials, wallet data, and messaging sessions. Earlier campaigns have pushed victims to run commands during fake calls, and related reporting on NimDoor malware tied fake Zoom updates to theft attempts against browser credentials, wallet data, and Telegram files.
JUMPSEC’s warning is blunt but sensible: a password reset is not a magic eraser. Stolen Telegram sessions can survive a password change, and malware already running on a device will not politely uninstall itself because the user changed credentials. If someone ran the requested script or installed a shady update during the call, the machine itself needs to be treated as compromised.
For defenders and crypto teams, the advice is straightforward:
- Verify unusual meeting links through another channel.
- Treat invitations from trusted accounts with caution if the request feels out of character.
- Avoid commands or “updates” presented during a call.
- Revoke exposed Telegram sessions; that logs out active devices and kills stolen session tokens.
- Isolate any device that ran the requested script.
- Review PowerShell activity, Defender exclusions, Keychain access, and new Telegram logins after a suspicious meeting.
That is boring security advice, which is usually the kind that saves your bacon. The glamorous version of crypto is sovereignty, self-custody, and freedom. The ugly version is a fake meeting room trying to talk you into handing over the keys.
Key takeaways
-
Why is this campaign more dangerous than ordinary phishing?
Because it does not just steal logins and hope for the best. It checks for wallet-related browser tools first, which helps the attackers focus on targets that are actually worth infecting. -
Why are Telegram, Zoom, and Teams such effective lures?
They are trusted tools in crypto and business circles. A hijacked Telegram account plus a believable meeting page can look normal enough to slip past casual suspicion. -
What does the wallet scanning actually look for?
It checks for Ethereum wallet connections through EIP-6963 and older methods, then looks for non-EVM tools such as Solana wallets and browser extension IDs associated with wallets like MetaMask. -
Does a password reset solve the problem?
Not necessarily. JUMPSEC warned that stolen Telegram sessions and malware already on the device may remain active, so cleanup has to go beyond changing a password. -
What should a crypto team do if a meeting invite looks off?
Confirm it through another channel, avoid running any commands or updates during the call, and treat the endpoint as suspect if anyone entered credentials, granted webcam access, or clicked a downloaded installer.
BlueNoroff Campaign: Exploiting Zoom and Teams for shows how much more dangerous crypto-targeting crews become when they combine social engineering with pre-infection reconnaissance. The defenses are not mysterious: verify links, distrust urgent update prompts, and assume a “trusted” Telegram message can turn into garbage the moment the account behind it gets hijacked.
Further reading
Related reporting and background on the same threat and adjacent crypto infrastructure fights:
- North Korea-Linked Actor Targets Web3 Execs in Social Engineering Campaign
- FBI Alert on Threat Actors Chaining Vulnerabilities in Ivanti Cloud
- BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
- Gram Rebrands Toncoin as Telegram Pushes TON Payments and Mini Apps
- Toncoin Jumps 22% as Telegram Integration Drives Real TON Demand
- Telegram Fined $430K in Russia as Outages Surge and Ban Looms
