{
 "tag": "fake-meeting",
 "name": "Fake Meeting",
 "group": "Other",
 "incidents": [
  {
   "slug": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "title": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "json": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto and DeFi fintech staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "unc1069",
    "masan",
    "cryptocore",
    "deepfake",
    "zoom",
    "fake-meeting",
    "clickfix",
    "telegram",
    "calendly",
    "macos",
    "mandiant",
    "gemini",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2026-02-09",
   "closedAt": "2026-02-09",
   "updatedAt": "2026-02-09T12:00:00Z",
   "summary": "Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount."
  },
  {
   "slug": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "title": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "json": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Web3 and crypto executives, founders and blockchain developers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "lazarus",
    "ghostcall",
    "ghosthire",
    "snatchcrypto",
    "fake-meeting",
    "fake-job-interview",
    "telegram",
    "github",
    "macos",
    "kaspersky",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-10-28",
   "closedAt": "2025-10-28",
   "updatedAt": "2025-10-28T12:00:00Z",
   "summary": "Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given."
  },
  {
   "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account."
   },
   "chains": [
    "ethereum"
   ],
   "method": "social-engineering",
   "product": "THORChain co-founder's personal wallet",
   "tags": [
    "ethereum",
    "social-engineering",
    "dprk",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "metamask",
    "zachxbt",
    "thorchain",
    "thorswap",
    "ai"
   ],
   "amountUsd": 1350000,
   "victims": 1,
   "startedAt": "2025-09-04",
   "closedAt": "2025-09-12",
   "updatedAt": "2025-09-12T12:00:00Z",
   "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected."
  },
  {
   "slug": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "title": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "json": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto foundation staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "ta444",
    "lazarus",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "calendly",
    "macos",
    "cryptobot",
    "infostealer",
    "huntress",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2025-06-11",
   "closedAt": "2025-06-18",
   "updatedAt": "2025-06-18T12:00:00Z",
   "summary": "Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen."
  },
  {
   "slug": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "title": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025",
   "json": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Startup founders in Polygon's investment network",
   "tags": [
    "multi-evm",
    "social-engineering",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "polygon",
    "malware",
    "founders",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-05-13",
   "closedAt": "2025-05-14",
   "updatedAt": "2025-05-14T12:00:00Z",
   "summary": "On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know."
  }
 ],
 "changes": [
  {
   "incident": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "incidentTitle": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-09",
   "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.",
   "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026"
  },
  {
   "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-28",
   "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.",
   "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-18",
   "title": "Huntress published its analysis, attributing the attack to BlueNoroff (TA444).",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-11",
   "title": "Huntress was contacted about the intrusion on the employee's Mac.",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-14",
   "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-13",
   "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  }
 ]
}