# BlueNoroff's Zoom Phishing Kit Targets Crypto Wallets North Korean hackers run a sophisticated phishing campaign aimed at cryptocurrency wallets. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-24 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/36de8c90-1d72-4de0-8d12-0869cbf6a633 ## New Tactics by North Korean Threat Actors The BlueNoroff hacking group impersonates popular video conferencing platforms like Zoom and Microsoft Teams to deceive users. Using social engineering techniques, the group infects targets with malware, specifically targeting cryptocurrency wallets. This campaign scans wallet data beforehand to select high-value victims. ## Abuse of Trusted Contacts Attackers hijack victims' trusted Telegram accounts to share fake meeting links. These links redirect to a page mimicking Zoom. When users grant webcam access, they encounter what appears to be a live stream but is actually an AI-generated video. ## Malware Delivery Process Victims are tricked with fake messages like 'your mic isn't working' into downloading malware disguised as a 'Zoom update.' This software detects crypto wallets on the system and delivers tailored malware to high-value targets. ## Telegram Account Takeover Once a victim's Telegram account is compromised, attackers use it to target others. This chain reaction allows the campaign to self-propagate. Each new victim becomes a resource for the next attack. ## Different Attack Chains for Windows and macOS On Windows, PowerShell is used to disable Defender and load a VBScript implant. On macOS, a fake Teams installer steals system data. Both operating systems are scanned for cryptocurrency wallets. ## AI-Powered Social Engineering Attackers combine AI-generated faces from OpenAI ChatGPT with real body movements captured in previous meetings. This makes victims trust what appears to be a familiar face. Each successful attack provides new material for the next. ## Risk for the Financial Services Sector This campaign poses a significant threat to companies managing crypto assets. BlueNoroff's target selection mechanism prioritizes high-value accounts. Organizations must train employees to recognize social engineering attacks. ## Sources covering this story - https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._