BlueNoroff Uses Fake Zoom and Microsoft Teams Phishing Kit to Target Cryptocurrency Users

Severity
Medium

Detail

Cybersecurity researchers have identified an active phishing kit operated by BlueNoroff, a North Korean threat actor group, that impersonates Zoom and Microsoft Teams in social engineering campaigns designed to deliver malware. According to JUMPSEC, BlueNoroff has developed an operator-driven victim acquisition platform that combines compromised industry contacts, social engineering, cryptocurrency wallet reconnaissance, and malware delivery. The campaign profiles victims’ cryptocurrency wallets before delivering malware, allowing the attackers to identify potentially high-value targets.

The campaign has been documented since early 2025, with activity involving ClickFix-style lures that trick victims into executing malicious commands by pretending to fix camera or audio issues during fake video meetings.

How?

The attackers begin by compromising legitimate Telegram accounts belonging to individuals in the cryptocurrency sector. These compromised accounts are then used to contact high-ranking employees of targeted companies and send meeting invitations through platforms such as Calendly.

The provided meeting link redirects victims to fake Zoom or Microsoft Teams websites hosted on typosquatted domains. The phishing pages request users to enter their names and allow webcam access. Once permission is granted, the victim’s webcam stream is sent to the attacker’s panel using mediasoup WebRTC.

After joining the fake meeting, victims are shown a simulated video conference page displaying a message indicating they are waiting for other participants. The attacker can then control the fake meeting, display fake microphone error messages, and trigger a fake “Zoom SDK Update” prompt that delivers the ClickFix payload.

Before malware delivery, the phishing kit performs browser fingerprinting to identify cryptocurrency wallet extensions installed on the victim’s browser.

Windows Attack Chain:

• The ClickFix command executes a PowerShell loader that downloads and runs a VBScript.
• The VBScript disables Microsoft Defender, adds the C:\Users directory to exclusion paths, and restarts Defender to apply the changes.
• The implant checks browser profiles for Telegram Web-related files to identify potential Telegram sessions.
• It enumerates installed browser extensions across Chrome, Edge, Brave, Opera, Vivaldi, and Firefox to identify cryptocurrency wallet extensions such as MetaMask.
• The implant can deliver additional payloads, although the exact payloads were not identified.

macOS Attack Chain:

• The ClickFix command executes a shell script that downloads a fake Teams or Zoom installer.
• The installer executes a stealer payload that collects system metadata and Google Chrome master keys stored in the iCloud Keychain.
• The stolen information is exfiltrated through a Telegram channel named “Aurora”.
• The malware can also deploy additional payloads.

The phishing kit supports both Zoom and Microsoft Teams lure variants. Researchers noted that the Teams version is more advanced, supporting emoji reactions, mobile and tablet blocking, and additional cryptocurrency wallet checks before malware delivery.

Impact

The campaign can result in the compromise of Telegram accounts, theft of sensitive system information, and cryptocurrency-related data. Victims who execute the payload while using Telegram Web or Telegram Desktop may have their Telegram sessions stolen and reused by attackers to target additional contacts.

The malware can collect cryptocurrency wallet information, browser data, system metadata, Google Chrome master keys, and other sensitive information. The campaign allows attackers to identify valuable cryptocurrency users before deploying malware.

Conclusion

BlueNoroff has developed a sophisticated phishing operation that combines trusted contact abuse, fake Zoom and Microsoft Teams meetings, ClickFix techniques, and cryptocurrency wallet reconnaissance to target high-value individuals. The campaign demonstrates how threat actors are increasingly focusing on compromising identities, relationships, and communication platforms to gain access to valuable cryptocurrency-related targets.

Source

https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html
https://www.jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfix-kit/