BlueNoroff Uses Fake Zoom and Teams Meetings to Target Crypto Users

A North Korea-linked hacking group, BlueNoroff, is using fake Zoom and Microsoft Teams meetings to profile cryptocurrency users before deploying malware. According to ChainCatcher, the attackers first take over trusted crypto industry contacts, then send seemingly normal meeting links through services such as Calendly that direct victims to fake Zoom or Teams domains. After users open the fake meeting page, it quietly scans browser wallets and uses wallet value to decide whether to continue the attack. The page then prompts users to update Zoom or Teams, or to run commands that download malware for Windows and macOS. The malware is designed to steal browser keys, system data, and Telegram sessions.