# Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks

- Severity: Medium · Status: Still active (past)
- Chains: Multiple EVM chains · Method: Social engineering and fake support
- Started: Oct 28, 2025 · Last update: Oct 28, 2025
- Who/what: Web3 and crypto executives, founders and blockchain developers
- AI involvement: AI-built malware. Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes.

Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given.

## Am I affected?
If an 'investor' or 'recruiter' on Telegram or LinkedIn had you join a meeting and run an audio or video 'fix', or run a GitHub test project, treat that computer as compromised.

## What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, SSH and API keys.
- Reinstall the operating system and tell your security team.

## How to avoid this
- Assume even trusted contacts' accounts can be hijacked; confirm on a second channel before opening links or files.
- Never run scripts or commands to fix a meeting problem.
- Run job-test code only in a throwaway virtual machine with no wallets or logins.

## Sources
- Kaspersky: BlueNoroff targets executives on Windows and macOS using AI-driven tools (Kaspersky, 2025-10-28): https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools

Full record: https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025 · JSON: https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.