Mitigating ELUSIVE COMET Zoom remote control attacks
Summary: Trail of Bits describes an encounter in which its CEO received fake 'Bloomberg Crypto' interview invitations from two separate Twitter accounts run by the threat actor ELUSIVE COMET, which refused email and scheduled through Calendly pages that were not official Bloomberg properties. The campaign abuses Zoom's remote control feature, whose permission dialog names the requester, to gain control of a target's computer, and the post ties the methodology to the $1.5 billion Bybit hack in February.
Bottom line: ELUSIVE COMET has taken millions in cryptocurrency through social engineering rather than code exploits, and the Zoom prompt it relies on looks like the routine notifications users are trained to approve. Trail of Bits' own answer was to deny Zoom accessibility permissions at the macOS system level so remote control cannot be enabled at all.
Read the original at Trail of Bits Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026