North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac
Crypto foundation staff on macOS
Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.
Why this severity: 1 victims, still active.
AI involvement
AI-made lures. Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- Jun 11, 2025
- Closed
- Jun 18, 2025
- Chains
- Multiple EVM chains
- Victims
- 1
Indicators · never visit or send to these
- support.us05web-zoom[.]biz
What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, API keys and Telegram sessions.
- Reinstall macOS on the affected machine and tell your security team.
Stay safe
Am I affected?
If you joined a 'Zoom' meeting from a Telegram or Calendly invite and were told to install an extension, plugin or script to fix sound, treat the computer as compromised.
What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, API keys and Telegram sessions.
- Reinstall macOS on the affected machine and tell your security team.
How to avoid this
- Faces and voices on a call are no longer proof; confirm meetings with colleagues on a second, known channel.
- Real Zoom never asks you to run an AppleScript or a terminal command; join only from zoom.us or the Zoom app.
- Be wary of last-minute platform switches and meeting links on odd domains such as .biz.
Timeline 2
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.