A dangerous new cyber campaign from North Korea\u2019s Lazarus Group is targeting cryptocurrency and Web3 professionals using fake Zoom meeting interfaces, fileless PowerShell scripts, and AI-generated deepfake content. <\/p>\n
The group behind this activity is BlueNoroff, a financially motivated subgroup known for stealing digital assets. <\/p>\n
This campaign has spread across more than 20 countries, with the United States making up 41% of all identified victims.<\/a><\/p>\n The attack begins with a spear-phishing email<\/a>. The threat actor pretends to be a legal professional in the Fintech space and sends a Calendly invite to the target. <\/p>\n Once the victim confirms the meeting, the attacker quietly replaces the Google Meet link with a typo-squatted Zoom URL designed to look nearly identical to a real one. <\/p>\n When the victim clicks the fake link, their browser loads a self-contained HTML page that looks exactly like the Zoom meeting<\/a> interface, complete with fake participant video tiles, looping footage, and a cycling active speaker indicator.<\/a><\/p>\n Arctic Wolf analysts identified this targeted intrusion<\/a> against a North American Web3 and cryptocurrency company, attributing it with high confidence to BlueNoroff, also tracked as APT38, Sapphire Sleet, and Stardust Chollima. <\/p>\n Researchers found that the full attack chain, from the initial click to complete system compromise, finished in under five minutes. <\/p>\n Forensic analysis confirmed the attacker maintained persistent access on the victim\u2019s device for 66 days, stealing browser credentials, Telegram session data, and live webcam footage that was then reused to build more convincing lures for future targets.<\/a><\/p>\n What makes this campaign especially damaging is its self-reinforcing deepfake production pipeline. Analysts uncovered more than 950 files on the attacker\u2019s hosting server, including AI-generated headshot images confirmed via C2PA cryptographic metadata as outputs of OpenAI\u2019s GPT-4o model, real webcam footage stolen from prior victims, and deepfake composite videos. <\/p>\n Each successful attack feeds raw material into the next, making future meetings more convincing. CEOs and founders account for 45% of all identified targets, reflecting BlueNoroff\u2019s focus on individuals with direct access to cryptocurrency assets and wallet infrastructure.<\/a><\/p>\n Once the victim enters the fake Zoom<\/a> meeting, a persistent overlay appears claiming the user\u2019s SDK is outdated and needs an update. <\/p>\n This is a ClickFix-style clipboard injection attack. The victim sees what look like harmless diagnostic commands and is told to copy and paste them into the Windows Run dialog or terminal. <\/p>\n What they do not realize is that the page silently replaces the clipboard content with a hidden PowerShell execution command the moment they copy it.<\/a><\/p>\n The injected PowerShell command downloads an obfuscated second-stage script from the attacker\u2019s command-and-control server and saves it to the user\u2019s Temp folder as a file named chromechip.log. <\/p>\n That file runs in a hidden window, installing a persistent C2 beacon that operates entirely in memory and contacts the attacker every five seconds. <\/p>\n The implant collects hostname, OS version, running processes, admin privileges, and timezone data, packaging everything into a structured JSON beacon<\/a> sent to a remote server.<\/a><\/p>\n Organizations in Web3, cryptocurrency, and financial services should verify all meeting links through a secondary communication method before joining any call. <\/p>\n Legitimate platforms never ask users to run terminal commands to fix audio or camera issues. <\/p>\n Security teams<\/a> should block identified C2 addresses, remove the Startup shortcut called Chrome Update Certificated.lnk, and delete chromechip.log and chrome-debug-data001.log from affected devices. <\/p>\n All browser-stored passwords, API keys, and cryptocurrency wallet credentials must be rotated immediately. <\/p>\n PowerShell Script<\/a> Block Logging should be enabled on all endpoints to support early detection of obfuscated payload execution.<\/a><\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post New BlueNoroff Campaign Uses Fileless PowerShell and AI-Generated Zoom Lures<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"DM](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiRuLUyE46q9s3Pe9NIHLioywkZNZlC7zpjzbxbxv8EulrGtFNrWe77jaH3EO8ujIaDc0isBa-ttKvetzDYEUe0Gj5dzS1wFCwjX_1APsoicIfLScLX8vWaDGf79R7qL0yWla8t56EyDCXtibzQe2I9BWpEjmXjTsCyUib-EipJ-56xnEuOAl48Hzd5-yw\/s16000\/DM%2520screenshot%2520showing%2520a%2520compromised%2520Telegram%2520account%2520impersonating%2520a%2520previous%2520victim%2520%28Source%2520-%2520Arctic%2520Wolf%29.webp?ssl=1\")
The ClickFix Payload Delivery<\/strong><\/h2>\n
![\"Zoom-branded](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiW2BVR255Z5vlk1HUaKivm5niLaAPzqScWsKr2I2JiCUX1fqbPKDdEafHeuIHvpirRvX0aDTOwKMfJN8MyEAyd-KlAl27GS_uxbv8RR5i384Y4bAwp2ho8MG3tPNCj2Uc3SRG0uzIQWcGwnfxgs4Y0iKfRtB5mbke7Q4KALQJZQke34Pfq9JDzFZZR674\/s16000\/Zoom-branded%2520fake%2520meeting%2520interface%2520with%2520%27SDK%2520deprecated%27%2520overlay%2520%28Source%2520-%2520Arctic%2520Wolf%29.webp?ssl=1\")
![\"Decoded](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0-gOx72iMQCl25dKh6Be-fUQjULW4q0voERVW_ahXfbyv-fIT6colQ8K3-tv59HaSsutflGmoGXsoV9w3XqNtle8TguHHfeavSKor9qmkcmAspcW9YWAcxTEqs-JXw5kjFn2iW7HIcuG3yFpwV4cPhUJy9qcVjw4p7kkL82cSX1o2GMlX4C46K7qHs_w\/s16000\/Decoded%2520PowerShell%2520C2%2520implant%2520showing%2520system%2520profiling%2520routine%2520and%2520JSON%2520beacon%2520structure%2520%28Source%2520-%2520Arctic%2520Wolf%29.webp?ssl=1\"){kind=tracking}