BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

Back Thehackernews

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

Thehackernews •[email protected] (The Hacker News) • July 24, 2026

Share: View original

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean BlueNoroff Uses AI for Sophisticated Zoom Phishing Attacks A North Korean cyber group, BlueNoroff, has developed a phishing kit that utilizes AI-generated faces to create convincing fake Zoom and Teams meetings targeting cryptocurrency executives. The kit employs pre-edited videos featuring deepfake headshots created with OpenAI's ChatGPT, enhancing its deception. Victims receive invites through compromised Telegram accounts of trusted contacts, leading them to typosquatted domains. Once engaged, the malware profiles installed cryptocurrency wallets and exfiltrates sensitive data. JUMPSEC identified five distinct versions of the kit between May 31 and July 14, 2026, indicating active development and refinement. This ongoing campaign poses significant risks to organizations relying on virtual meetings for critical transactions. 13 sources 73

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)

T1566 - Phishing