# North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac

- Severity: Medium · Status: Still active (past)
- Chains: Multiple EVM chains · Method: Social engineering and fake support
- Started: Jun 11, 2025 · Last update: Jun 18, 2025 · Victims: 1
- Who/what: Crypto foundation staff on macOS
- AI involvement: AI-made lures. Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install.

Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.

## Am I affected?
If you joined a 'Zoom' meeting from a Telegram or Calendly invite and were told to install an extension, plugin or script to fix sound, treat the computer as compromised.

## What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, API keys and Telegram sessions.
- Reinstall macOS on the affected machine and tell your security team.

## How to avoid this
- Faces and voices on a call are no longer proof; confirm meetings with colleagues on a second, known channel.
- Real Zoom never asks you to run an AppleScript or a terminal command; join only from zoom.us or the Zoom app.
- Be wary of last-minute platform switches and meeting links on odd domains such as .biz.

## Indicators (block these, never visit them)
- Domain: support.us05web-zoom[.]biz

## Sources
- Inside the BlueNoroff Web3 macOS Intrusion Analysis (Huntress, 2025-06-18): https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis

Full record: https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025 · JSON: https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.