BlueNoroff Uses Fake Zoom and Teams Meetings to Target Crypto Users

North Korean hacking group BlueNoroff is using fake Zoom and Microsoft Teams meetings to profile crypto users and deploy malware. According to Odaily, the group first takes over accounts belonging to trusted crypto industry contacts, then sends apparently normal meeting links through tools such as Calendly that lead to fake Zoom and Teams domains. After users open the fake meeting pages, the pages scan wallets in the browser and decide whether to continue the attack based on wallet value. The fake meetings also ask users to update Zoom or Teams or run commands, which instead download malware for Windows and macOS.