North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech
Crypto and DeFi fintech staff on macOS
Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.
Why this severity: 1 victims, still active.
AI involvement
AI-made lures. The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- Feb 9, 2026
- Closed
- Feb 9, 2026
- Chains
- Multiple EVM chains
- Victims
- 1
Indicators · never visit or send to these
- mylingocoin[.]com
- zoom.uswe05[.]us
- supportzm[.]com
- zmsupport[.]com
- breakdream[.]com
- dreamdie[.]com
- support-zoom[.]us
- cmailer[.]pro
What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, Telegram sessions and browser-saved logins.
- Reinstall the operating system; this malware changes macOS privacy settings and installs a browser extension.
Stay safe
Am I affected?
If you joined a 'Zoom' call from a Telegram contact's Calendly link and then ran commands to fix your audio, treat the computer as compromised.
What to do now
- From a clean device, move funds to new wallets and rotate passwords, 2FA, Telegram sessions and browser-saved logins.
- Reinstall the operating system; this malware changes macOS privacy settings and installs a browser extension.
How to avoid this
- A face on a video call is no longer proof; confirm the meeting with the person through a second, known channel.
- Never paste commands into Terminal or Run because someone on a call asks you to.
- Join meetings only from the official Zoom app or zoom.us, and check the link's domain.
Timeline 1
Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.
Source
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.