A new social-engineering campaign linked to North Korea is targeting cryptocurrency executives, blockchain developers, exchange operators, and decentralized finance professionals through fake Zoom and Microsoft Teams meetings. Instead of relying only on conventional phishing emails, the attackers create convincing meeting invitations, impersonate trusted contacts, and use lookalike video-conferencing websites to inspect a victim’s digital environment.
The campaign is associated with BlueNoroff, a financially motivated group linked to the broader Lazarus Group ecosystem. Its objective is not simply to steal login credentials. Researchers have identified tools designed to detect browser-based wallets, cryptocurrency extensions, Telegram sessions, and other assets that could help attackers decide whether a victim is worth pursuing further.
The technique is especially dangerous because the fake meeting may appear to come from someone the target already knows. In some cases, attackers reportedly abuse compromised Telegram accounts and send invitations through existing professional relationships. Once a victim opens the fraudulent meeting page, hidden scripts can begin collecting information before any malware is installed.
Security researchers have described the operation as a repeatable crypto phishing campaign that combines reconnaissance, impersonation, wallet discovery, and malware delivery. More than 80 deceptive Zoom or Teams domains were reportedly registered during a five-month period beginning in late 2025, while approximately 100 executives across more than 20 countries were targeted Â
How the fake Zoom crypto attack works
The campaign follows a carefully planned sequence. Each stage is designed to make the next step appear normal, which reduces the chance that a target will recognize the intrusion.
Initial contact through a trusted account
The first contact may arrive through Telegram, email, LinkedIn, Calendly, or another professional communication platform. A message might propose a partnership discussion, an investor call, a job interview, or a technical meeting. The invitation usually appears relevant to the target’s role and may refer to a current project, a known company, or a familiar person in the cryptocurrency sector.
This approach is more effective than sending random messages because the attackers conduct victim reconnaissance in advance. They may study public social-media posts, company websites, conference appearances, blockchain projects, and professional connections. That information helps them construct a credible scenario around the meeting.
A compromised Telegram account can make the deception even more convincing. If the invitation comes from an established contact, the recipient may click without performing the same checks they would apply to an unknown sender. This is why a trusted account should not automatically be treated as proof that a message is legitimate.
Redirecting victims to a lookalike meeting page
The invitation commonly includes a link that resembles a genuine Zoom or Microsoft Teams address. Attackers may register typosquatted domains, using slight spelling changes or alternative domain endings to imitate legitimate services.
When the target opens the link, the page may display familiar branding, meeting-room graphics, a loading screen, or an error message claiming that a software update is required. The page may also request permission to access the microphone or camera. In some variations, the victim is encouraged to download a meeting client or run a command to resolve an audio or video problem.
The website can be hosted on an attacker-controlled server while appearing visually identical to a real video-conferencing platform. Because many users join meetings through browser links, they may not notice that the address bar contains an unfamiliar domain.
Scanning the browser for cryptocurrency wallets
The most notable feature of the campaign is its ability to perform crypto wallet reconnaissance before delivering additional malware. JavaScript running on the fraudulent meeting page can inspect the browser environment for signs of installed wallet software.
Researchers have reported that the phishing kit checks for Ethereum wallet connections through EIP-6963 and older browser-detection methods. It can also look for non-EVM wallet tools, including software associated with Solana. On Windows systems, the malware may collect browser-extension identifiers from Chrome, Edge, Brave, Opera, Vivaldi, Firefox, and related browsers.
The scan does not necessarily mean that the attacker can immediately transfer funds. In many cases, the purpose is to identify promising victims. Someone with MetaMask, Phantom, a hardware-wallet management tool, or access to an exchange administration panel may represent a more valuable target than someone without crypto-related software.
This makes the operation different from a basic phishing page. Rather than treating every visitor identically, the attackers can use the collected information to prioritize targets and choose whether to launch a more invasive second stage.
Why cryptocurrency professionals are being targeted
Cryptocurrency organizations often operate across borders and depend on remote collaboration. Developers, founders, investors, auditors, and exchange employees may regularly join meetings with people they have never met in person. This creates opportunities for attackers to hide inside normal business activity.
Access to private keys and wallet infrastructure
Many Web3 professionals have direct or indirect access to sensitive resources, including private keys, seed phrases, wallet extensions, treasury systems, deployment accounts, and exchange administration panels. A compromise of one employee can therefore expose considerably more than that person’s individual holdings.
A developer may have permission to publish code or manage deployment pipelines. An operations employee may be able to approve transactions. A founder may have access to a project treasury. An exchange administrator may control hot-wallet infrastructure. Attackers can use reconnaissance to identify which role each person holds and tailor the next stage accordingly.
High-value digital assets are difficult to recover
Cryptocurrency transactions are generally irreversible once confirmed on a blockchain. If an attacker obtains a seed phrase or private key and transfers assets to another address, recovering those funds can be difficult. This increases the value of early detection and makes wallet security a priority before a suspicious transaction occurs.
The North Korean government has repeatedly been accused by international authorities and cybersecurity researchers of using cryptocurrency theft to generate revenue and evade sanctions. Earlier campaigns attributed to North Korean groups have targeted exchanges, blockchain projects, decentralized applications, and individual crypto users.
Remote work increases trust-based risks
Remote work has made video meetings an essential part of business operations. Employees are accustomed to installing updates, troubleshooting microphone issues, opening shared documents, and joining unfamiliar meeting rooms. Attackers exploit these habits by presenting malicious actions as routine technical requests.
A fake Zoom call is particularly effective because it combines multiple forms of social engineering. The victim may see a familiar name, a professional meeting invitation, a realistic landing page, and a convincing explanation for why software must be installed. Each element reinforces the others.
BlueNoroff’s evolving social-engineering strategy
BlueNoroff has traditionally been associated with attacks against financial institutions and cryptocurrency businesses. Its newer campaigns show a shift toward more personalized and technically sophisticated deception.
From phishing messages to complete victim pipelines
Earlier phishing campaigns often depended on a single malicious document or fake login page. The latest operation appears more systematic. Attackers can identify potential victims, send personalized invitations, collect information about wallet software, and then decide whether to deliver malware.
This creates what researchers describe as a victim pipeline. Each successful compromise can help attackers reach additional people. If one Telegram account is taken over, it may provide access to the victim’s contacts and conversations. Those relationships can then be used to send new invitations that look authentic.
The approach enables attackers to scale their campaign without abandoning personalization. Automated scripts can conduct technical scans, while human operators continue the conversation and manipulate the target.
AI-generated content makes impersonation more convincing
Security researchers have also found evidence that stolen meeting footage and AI-generated images may be used to create fabricated content for future social-engineering attacks. This could allow criminals to imitate executives, investors, consultants, or other recognizable people.
Generative AI does not need to create a perfect video to be useful. A short clip, profile image, or manipulated meeting background may be enough to increase credibility. Attackers can combine these materials with public information to construct a believable identity.
For recipients, visual familiarity should not replace independent verification. A recognizable face or voice can be manipulated, particularly when the meeting is brief, the video quality is poor, or the attacker keeps the discussion focused on a technical problem.
The malware threat behind fake meeting invitations
The fake meeting page may be used only for reconnaissance, but it can also lead to malware installation. The attacker may tell the victim that a required codec, meeting client, browser extension, or audio driver must be installed.
Credential and wallet theft
Malware associated with North Korean cryptocurrency campaigns has been designed to search browsers, messaging applications, local files, and wallet-related directories. Some variants look for seed phrases, mnemonic terms, wallet databases, authentication tokens, and saved credentials.
Browser extensions are a major target because many users interact with cryptocurrency applications through extensions rather than standalone desktop programs. If malicious software can access browser data or capture activity while a wallet is unlocked, it may provide attackers with valuable opportunities.
A password reset may not be enough after a suspected compromise. Stolen browser sessions, authentication cookies, Telegram sessions, and private keys can remain useful even after a password has changed. Incident response must therefore consider active sessions, wallet permissions, endpoint persistence, and transaction history.
Cross-platform targeting
The campaign has reportedly included tooling for both Windows and macOS environments. This matters because cryptocurrency companies often use mixed-device fleets. A security program that protects only Windows workstations may leave developers using Mac computers exposed to the same social-engineering scheme.
Cross-platform malware may use different delivery techniques on each operating system. A Windows payload could abuse PowerShell or browser data, while a macOS payload might request the user to execute a command in Terminal or install an untrusted application. The user-facing story remains similar: the meeting is allegedly broken and a fix must be applied.
Telegram session compromise
Telegram accounts are valuable because they contain contacts, project discussions, authentication messages, and evidence of professional relationships. If an attacker steals a session, they may not need to create a new identity. They can send messages from the compromised account and exploit the victim’s existing trust network.
Organizations should treat unexpected messages from known contacts as potentially suspicious when they include urgent meeting requests, unfamiliar links, software downloads, or instructions to run commands. Verification through a separate channel, such as a known phone number or an independently located corporate address, can interrupt the attack.
Warning signs of a fake Zoom or Teams call
The strongest warning sign is a meeting link that does not lead to the official service domain or to a company-managed meeting system. A link may look almost correct while containing an extra character, unusual subdomain, misspelling, or unfamiliar top-level domain.
Another warning sign is an invitation that creates urgency. Attackers may claim that an investor is waiting, a limited-time opportunity is expiring, or a technical issue must be fixed immediately. Pressure makes people less likely to verify details.
Requests to install software should receive special scrutiny. A legitimate participant generally should not ask a meeting attendee to download an unofficial application, disable security controls, paste commands into Terminal, or share a seed phrase. No video meeting requires a cryptocurrency wallet’s recovery phrase.
Unusual behavior from the supposed sender is also important. A message may use a different writing style, appear at an odd hour, contain a new type of request, or avoid answering basic questions. If the sender’s account has been compromised, the account itself may look legitimate while the conversation does not.
How crypto companies can defend against the campaign
Protection requires more than warning employees not to click suspicious links. Cryptocurrency organizations should combine technical controls, identity verification, endpoint security, and transaction safeguards.
Verify meetings out of band
Employees should confirm unexpected invitations through an independent communication method. If a message arrives on Telegram, the recipient can contact the person through a known corporate email address or a previously verified phone number. The confirmation should not rely on the same account or link included in the original invitation.
Companies can also maintain approved domains and meeting procedures. For example, a policy might require external meetings to be scheduled through a corporate calendar and hosted on an approved platform. Exceptions should be documented rather than handled informally.
Block unauthorized software and scripts
Endpoint controls should prevent users from installing unapproved applications and running unknown scripts. Application allowlisting, email filtering, browser protection, and DNS monitoring can reduce exposure to malicious meeting domains.
Security teams should monitor for suspicious activity after a fake meeting, including new browser extensions, unexpected PowerShell execution, unusual Terminal commands, changes to security settings, and access to credential stores. Logs from identity providers, endpoint detection systems, and messaging platforms should be retained long enough to support investigation.
Separate daily devices from wallet operations
Employees should avoid managing significant treasury funds from ordinary browsing devices. High-value wallets should use hardware security modules, multisignature approval, dedicated transaction workstations, or hardware wallets with clear operational controls.
A multisignature wallet can reduce the impact of one compromised employee because a single stolen credential may not be sufficient to authorize a transfer. Transaction limits, time delays, allowlisted addresses, and independent approval workflows can provide additional protection.
Protect recovery phrases and private keys
Seed phrases should never be entered into a website, video call, chat message, or software tool at another person’s request. They should not be stored in cloud notes, screenshots, email drafts, or unencrypted text files.
Teams should establish written procedures for key generation, backup, rotation, emergency response, and access revocation. The fewer devices and people that handle sensitive key material, the smaller the attack surface becomes.
What individuals should do after joining a suspicious call
Anyone who opened a suspicious meeting page should disconnect from the session and avoid interacting with further prompts. If software was downloaded, the device should be removed from sensitive accounts and isolated from the network where practical.
The user should notify the organization’s security team, preserve relevant messages and URLs, and avoid deleting evidence before it can be collected. Security specialists may need to examine browser extensions, running processes, recent downloads, login sessions, and system changes.
If the user entered credentials, those credentials should be changed from a known-clean device. All active sessions should be revoked, and multifactor authentication methods should be reviewed. If a wallet seed phrase or private key was exposed, the assets should be transferred to a newly created secure wallet immediately, provided the device used for the transfer is trustworthy.
Teams should inspect blockchain activity for unfamiliar approvals, token permissions, contract interactions, and outgoing transfers. A wallet can be at risk even when no funds have yet moved. Revoking malicious token approvals may be necessary, but approval revocation should be performed carefully and preferably with assistance from a qualified security professional.
The wider lesson for Web3 security
The fake Zoom campaign demonstrates that cryptocurrency security is not only a matter of smart-contract audits or wallet encryption. Human relationships, calendars, messaging accounts, and video meetings are now part of the attack surface.
Web3 companies often focus heavily on protecting on-chain infrastructure while underestimating the endpoints used by developers and executives. Yet a compromised laptop can expose credentials, source code, cloud access, wallet extensions, and communications at the same time.
The most effective defense is layered. A company should assume that one employee may eventually click a malicious link and design controls that limit the consequences. Strong identity management, hardware-backed authentication, least-privilege access, isolated signing devices, verified communications, and rapid incident response can make a successful intrusion far less damaging.
Security awareness training should also use realistic scenarios. Employees need to practice how to challenge unusual requests from trusted contacts, how to verify meeting links, and how to report suspected compromises without fear of blame. Training is most effective when it reflects the social situations employees actually encounter.
Conclusion
North Korea hackers scanning crypto wallets through fake Zoom calls reflects a broader evolution in cybercrime: attackers are combining trusted communication channels, realistic impersonation, automated browser reconnaissance, and cross-platform malware into a single campaign.
BlueNoroff’s reported activity shows why cryptocurrency users should not judge a meeting invitation by its branding or apparent sender alone. A fake call may be designed to gather information before the attacker attempts credential theft, malware installation, or wallet compromise.
Individuals should verify unexpected invitations, avoid running commands provided during calls, refuse all requests for seed phrases, and use separate secure devices for valuable wallet operations. Crypto companies should reinforce these habits with endpoint controls, multisignature approvals, hardware-backed authentication, strict access management, and tested incident-response procedures.
The central lesson is simple: a video meeting is not automatically safe because it appears professional or comes from a familiar account. Treat every unexpected link, download, and technical request as a potential security event until it has been independently verified.
FAQs
Q. What are North Korean hackers looking for in crypto wallets?
They may look for wallet extensions, browser connections, private keys, seed phrases, authentication sessions, exchange credentials, and access to blockchain infrastructure.
Q. Can a fake Zoom meeting steal cryptocurrency without asking for a seed phrase?
Yes. A malicious website or infected device may expose browser data, session tokens, wallet extensions, credentials, or transaction activity.
Q. How can I tell whether a Zoom invitation is fake?
Check the full web address carefully, confirm that the invitation came through a trusted channel, and verify unusual requests with the supposed sender through another method.
Q. What should I do if I ran a command during a suspicious crypto call?
Disconnect the device from sensitive accounts and notify your security team or a qualified incident-response professional.
Q. Are hardware wallets enough to stop fake Zoom crypto scams?
Hardware wallets significantly reduce some risks, but they are not a complete defense. Attackers may still target exchange accounts, browser sessions, developer credentials, approval permissions, or recovery phrases.
