Mandiant
1 incident, 0 live. 255 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
Past
February 2026 1
-
North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech
Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.
Crypto and DeFi fintech staff on macOS·Multiple EVM chains·Since Feb 9, 2026·
No drains match these filters.