Back Feeds.4Sysops

BlueNoroff keeps upgrading Zoom phishing kit with wallet profiling and deepfakes

Feeds.4Sysops •IT News • July 24, 2026

BlueNoroff is actively refining its fake Zoom and Microsoft Teams infrastructure, with five phishing-kit versions identified between May 31 and July 14, 2026, and media servers containing more than 950 files. The kit fingerprints browsers for installed cryptocurrency wallets before delivering malware, allowing operators to prioritize high-value victims. It reaches targets through typosquatted meeting links sent by hijacked Telegram accounts belonging to trusted cryptocurrency contacts. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean BlueNoroff Uses AI for Sophisticated Zoom Phishing Attacks A North Korean cyber group, BlueNoroff, has developed a phishing kit that utilizes AI-generated faces to create convincing fake Zoom and Teams meetings targeting cryptocurrency executives. The kit employs pre-edited videos featuring deepfake headshots created with OpenAI's ChatGPT, enhancing its deception. Victims receive invites through compromised Telegram accounts of trusted contacts, leading them to typosquatted domains. Once engaged, the malware profiles installed cryptocurrency wallets and exfiltrates sensitive data. JUMPSEC identified five distinct versions of the kit between May 31 and July 14, 2026, indicating active development and refinement. This ongoing campaign poses significant risks to organizations relying on virtual meetings for critical transactions. 13 sources 73

Extracted Entities

BlueNoroff keeps upgrading Zoom phishing kit with wallet profiling and deepfakes

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)