Question 1

Who is behind the fake Zoom and Teams attacks?

Accepted Answer

BlueNoroff is behind it, a financially motivated subgroup of North Korea's Lazarus Group. Researchers link the group to numerous crypto thefts aimed at funding the North Korean state.

Question 2

How does the attack steal crypto?

Accepted Answer

The fake meeting page scans the victim's browser for wallets first. An operator then triggers a bogus software-update prompt that runs a ClickFix command, installing malware that harvests wallet credentials, system data and Telegram files on Windows or macOS.

Question 3

How many people have been targeted?

Accepted Answer

Arctic Wolf identified more than 100 victims across over 20 countries, with 41% in the United States. About 80% worked in crypto or blockchain finance, and 45% were founders or CEOs.

BlueNoroff

BlueNoroff scans crypto wallets in fake Zoom calls before dropping malware

One sharp brief.
Every day.

BlueNoroff

BlueNoroff scans crypto wallets in fake Zoom calls before dropping malware

One sharp brief.Every day.

One sharp brief.
Every day.