Cryptobot
1 incident, 0 live.
0 drains in the last 12 months
0 drains in the last 12 months
0 drains in the last 12 months
1 drains in 2025
1 drains in 2025
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½
Less More
Past
June 2025 1
-
North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac
Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.
Crypto foundation staff on macOS·Multiple EVM chains·Since Jun 11, 2025·
No drains match these filters.