BlueNoroff Enhances Zoom Phishing Kit with Crypto Wallet Profiling and Deepfakes

BlueNoroff has upgraded its phishing kit targeting Zoom and Microsoft Teams, with five versions identified from May 31 to July 14, 2026. The kit now includes browser fingerprinting to detect installed cryptocurrency wallets, enabling attackers to focus on high-value targets. Phishing attempts are executed through typosquatted meeting links sent via hijacked Telegram accounts of trusted cryptocurrency contacts. More than 950 files are hosted on media servers associated with this campaign. This targeted approach raises concerns for enterprise leaders in the cryptocurrency sector. The ongoing evolution of this phishing kit indicates a significant threat to users of these platforms.

Key Points: • BlueNoroff's phishing kit has five updated versions identified since late May 2026. • The kit profiles cryptocurrency wallets to prioritize high-value victims. • Phishing links are sent via hijacked Telegram accounts of trusted contacts.