Blue Noroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
Summary: JUMPSEC reported that BlueNoroff, the North Korean threat group, runs an active phishing kit that impersonates Zoom and Microsoft Teams, distributing lure links from hijacked Telegram accounts of cryptocurrency contacts to reach employees at major companies. The kit profiles victims' cryptocurrency wallets before malware delivery, streams their webcam to an operator panel via mediasoup WebRTC, and uses AI-generated headshots from OpenAI ChatGPT composited over real body movements to make the fake meeting look familiar.
Bottom line: Every victim who runs the payload with Telegram Web open or Telegram Desktop installed can have their session stolen and reused against their own contacts, so one compromise feeds the next. JUMPSEC found five distinct kit versions between May 31 and July 14, 2026, and tied a hard-coded bot token to an operator using the handle @alchemy_john_mac.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026