Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks
Web3 and crypto executives, founders and blockchain developers
Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given.
Why this severity: Still active, a narrower target.
AI involvement
AI-built malware. Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes.
Check that a package, extension or app is the real one before installing it, even when an AI assistant suggested it.
- Started
- Oct 28, 2025
- Closed
- Oct 28, 2025
- Chains
- Multiple EVM chains
At risk
- Web3 and crypto executives, founders and blockchain developers
- Multiple EVM chains wallets
What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, SSH and API keys.
- Reinstall the operating system and tell your security team.
Stay safe
Am I affected?
If an 'investor' or 'recruiter' on Telegram or LinkedIn had you join a meeting and run an audio or video 'fix', or run a GitHub test project, treat that computer as compromised.
What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, SSH and API keys.
- Reinstall the operating system and tell your security team.
How to avoid this
- Assume even trusted contacts' accounts can be hijacked; confirm on a second channel before opening links or files.
- Never run scripts or commands to fix a meeting problem.
- Run job-test code only in a throwaway virtual machine with no wallets or logins.
Timeline 1
Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.
Source
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.