Zoom
4 incidents, 0 live. 255 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
3 drains in 2025
Past
February 2026 1
-
North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech
Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.
Crypto and DeFi fintech staff on macOS·Multiple EVM chains·Since Feb 9, 2026·
September 2025 1
-
THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend
In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.
THORChain co-founder's personal wallet·Ethereum·$1.4M stolen·Since Sep 4, 2025·
June 2025 1
-
North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac
Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.
Crypto foundation staff on macOS·Multiple EVM chains·Since Jun 11, 2025·
May 2025 1
-
Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account
On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know.
Startup founders in Polygon's investment network·Multiple EVM chains·Since May 13, 2025·
No drains match these filters.