BlueNoroff Deploys Fake Meeting Malware to Scan Crypto Wallets

North Korean-linked BlueNoroff uses spoofed Zoom/Teams links to scan browser wallets, deploying malware to steal keys and data based on asset value.

Woofun AI reports that the North Korean-linked hacker group BlueNoroff exploits fake Zoom and Microsoft Teams meetings to target cryptocurrency users. The attackers compromise trusted industry accounts to distribute deceptive meeting links via Calendly, directing victims to counterfeit domains. Upon entry, the interface silently scans browser wallets, initiating further attacks only if significant value is detected. Users are prompted to "update" software, which actually installs malware on Windows and macOS systems to exfiltrate browser keys, system data, and Telegram sessions.