{
 "slug": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
 "title": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
 "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
 "json": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "active",
 "verification": "verified",
 "ai": {
  "role": "ai-lure",
  "note": "The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research."
 },
 "chains": [
  "multi-evm"
 ],
 "method": "social-engineering",
 "product": "Crypto and DeFi fintech staff on macOS",
 "tags": [
  "multi-evm",
  "social-engineering",
  "dprk",
  "unc1069",
  "masan",
  "cryptocore",
  "deepfake",
  "zoom",
  "fake-meeting",
  "clickfix",
  "telegram",
  "calendly",
  "macos",
  "mandiant",
  "gemini",
  "ai"
 ],
 "amountUsd": null,
 "victims": 1,
 "startedAt": "2026-02-09",
 "closedAt": "2026-02-09",
 "updatedAt": "2026-02-09T12:00:00Z",
 "summary": "Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.",
 "timeline": [
  {
   "date": "2026-02-09",
   "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.",
   "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering",
   "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering",
   "publisher": "Google Cloud (Mandiant)",
   "date": "2026-02-09"
  }
 ],
 "indicators": {
  "domains": [
   "mylingocoin[.]com",
   "zoom.uswe05[.]us",
   "supportzm[.]com",
   "zmsupport[.]com",
   "breakdream[.]com",
   "dreamdie[.]com",
   "support-zoom[.]us",
   "cmailer[.]pro"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you joined a 'Zoom' call from a Telegram contact's Calendly link and then ran commands to fix your audio, treat the computer as compromised.\n\n## What to do now\n- From a clean device, move funds to new wallets and rotate passwords, 2FA, Telegram sessions and browser-saved logins.\n- Reinstall the operating system; this malware changes macOS privacy settings and installs a browser extension.\n\n## How to avoid this\n- A face on a video call is no longer proof; confirm the meeting with the person through a second, known channel.\n- Never paste commands into Terminal or Run because someone on a call asks you to.\n- Join meetings only from the official Zoom app or zoom.us, and check the link's domain.",
 "notes": null,
 "agentBrief": "# North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech\n\n- Severity: Medium · Status: Still active (past)\n- Chains: Multiple EVM chains · Method: Social engineering and fake support\n- Started: Feb 9, 2026 · Last update: Feb 9, 2026 · Victims: 1\n- Who/what: Crypto and DeFi fintech staff on macOS\n- AI involvement: AI-made lures. The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research.\n\nMandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.\n\n## Am I affected?\nIf you joined a 'Zoom' call from a Telegram contact's Calendly link and then ran commands to fix your audio, treat the computer as compromised.\n\n## What to do now\n- From a clean device, move funds to new wallets and rotate passwords, 2FA, Telegram sessions and browser-saved logins.\n- Reinstall the operating system; this malware changes macOS privacy settings and installs a browser extension.\n\n## How to avoid this\n- A face on a video call is no longer proof; confirm the meeting with the person through a second, known channel.\n- Never paste commands into Terminal or Run because someone on a call asks you to.\n- Join meetings only from the official Zoom app or zoom.us, and check the link's domain.\n\n## Indicators (block these, never visit them)\n- Domain: mylingocoin[.]com\n- Domain: zoom.uswe05[.]us\n- Domain: supportzm[.]com\n- Domain: zmsupport[.]com\n- Domain: breakdream[.]com\n- Domain: dreamdie[.]com\n- Domain: support-zoom[.]us\n- Domain: cmailer[.]pro\n\n## Sources\n- UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering (Google Cloud (Mandiant), 2026-02-09): https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering\n\nFull record: https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026 · JSON: https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}