BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine
Do Son 
PowerShell payload copied to clipboard | Image: JUMPSEC
At a glance
| Field | Detail |
|---|---|
| Actor / group | BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group |
| Activity type | ClickFix phishing kit faking Zoom and Teams meetings |
| Targets | Web3 and cryptocurrency staff, often senior employees |
| Scale | 60+ hostnames across 10 IPs; four macOS variants (Apr 22 – Jul 15, 2026) |
| Attribution status | State-sponsored (DPRK); high confidence; no arrests reported |
| Source | JUMPSEC research report |
TL;DR
JUMPSEC recovered and analyzed the source code behind an active BlueNoroff phishing kit. The kit fakes Zoom and Teams meetings, profiles a victim’s crypto wallets, then delivers a ClickFix attack. Operators exposed JavaScript source maps on live servers, which handed researchers rare source-level visibility.
What Happened
North Korea’s BlueNoroff group built a fake meeting platform, not just a lure page. JUMPSEC obtained the code after operators left .map files on live infrastructure. Those files mapped minified JavaScript back to readable source, comments and all.
The firm frames the operation bluntly. It calls the kit “less a phishing page and more a complete victim management platform”. That framing matters, because the BlueNoroff phishing kit chains several steps into one pipeline.
The lure arrives from a trusted contact. Attackers hijack real Telegram accounts of people in crypto, then message senior staff at major firms. A Calendly link follows, and it points to a lookalike Zoom or Teams domain.
Inside the fake meeting
The victim joins what looks like a normal call. Behind the scenes, the page sweeps the browser for wallet extensions. It probes for Ethereum wallets through EIP-6963 and older methods, plus non-EVM wallets like Solana. Results stream to an operator panel in silence.
Next, an “admin” appears on screen. The face is not a live webcam feed. It is a pre-edited, AI-generated video composited over real body motions from earlier calls. The operator then complains about a broken mic and pushes a fake “Zoom SDK update”.
That prompt is the ClickFix attack. When the victim copies the “fix” command, the clipboard swaps in a hidden payload.
Two operating systems, one goal
On Windows, the command runs a small PowerShell loader. It fetches a VBScript implant, adds a Defender exclusion, then restarts Defender so the change sticks. VirusTotal flagged that implant as Trojan.NukeSped, a known Lazarus family.
On macOS, a fake installer keeps the user busy while a stealer runs behind it. The stealer pulls the Chrome master key from the Keychain and sends it out through a Telegram bot. JUMPSEC watched stolen data land in a channel named “Aurora”.
Who Is Behind It
JUMPSEC attributes the campaign to BlueNoroff, also tracked as TA444, with high confidence. The group is a financially motivated arm of the DPRK’s Lazarus Group.
Several signals support that call. Infrastructure and the ClickFix technique match an April 2026 Arctic Wolf report on the same campaign. The NukeSped classification, the wallet-filtering logic, and the SDK-update lure all fit prior BlueNoroff tradecraft. Every server sat on Cloudzy, a host already tied to DPRK and Iranian activity.
Researchers also found a live Telegram bot token in the binary. It surfaced an operator alias, “John”, who asked crypto group admins about a vesting contract. No suspect has been charged, and that name is likely fake.
Impact and Scale
The reach is wide. Pivoting from 11 seed domains, JUMPSEC mapped more than 60 hostnames across 10 IPs on a single network. Four macOS payload variants appeared between April and July 2026, showing steady development.
The human angle is the real risk. As the report puts it, “the sender was a real person the target trusted, their account was simply hijacked”. Standard sender checks fail against that. Stolen crypto figures tied to this kit remain unconfirmed.
What Comes Next and How to Stay Safe
Treat meeting invites over Telegram with care, even from long-time contacts. Verify out-of-band before you click, using a channel you set up yourself.
Inspect the domain in any Zoom, Teams, or Google Meet link. If it resolves to Cloudzy infrastructure, stay away. Above all, never paste commands from a “meeting fix” prompt into a terminal or the Run box. That single click is the whole ClickFix attack. Security teams should hunt for Defender exclusion changes, odd wscript.exe activity, and Keychain access by the security tool.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
