1. Executive summary
A North Korean threat cluster attributed as BlueNoroff (MITRE G0082) is operating an active, operator-driven phishing kit that impersonates Zoom and Microsoft Teams via typosquatted domains to deliver ClickFix-style malware payloads. The campaign uses hijacked Telegram accounts of trusted cryptocurrency-industry contacts to distribute Calendly links that redirect victims to fake videoconferencing pages; the kit fingerprints browser-installed cryptocurrency wallets before selectively delivering malware to high-value targets. The attack chain is self-propagating: each compromised Telegram session is reused to target the victim's own contacts. EMEA financial services firms with cryptocurrency-adjacent business lines, digital asset custody operations, or employees active in crypto communities face elevated targeting risk from this social-engineering pipeline.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | The campaign constitutes a targeted cyber threat against financial entities with crypto-adjacent operations, requiring classification per the threat taxonomy. | Classify this campaign as a targeted social-engineering threat in your ICT incident register; ensure detection and response playbooks reflect the Telegram-account-hijack-to-malware chain. |
| DORA Art. 17: ICT-related incident management process | The self-propagating Telegram session-theft mechanism means a single employee compromise can cascade into multi-account intrusions, engaging the incident management process. | Update incident response runbooks to include Telegram session-token theft as a containment scenario with session-revocation steps. |
3. Technical analysis & attack chain
Attribution note: BlueNoroff is tracked as MITRE G0082. The related cluster "ClickFake Interview" (tracked by Sekoia) is described as "North Korea-aligned" but has no MITRE profile in the verified reference data; that attribution should be treated as unconfirmed. The detailed technical findings in this advisory are single-sourced to the JUMPSEC report shared with The Hacker News; verify before enforcement.
Attack chain (confirmed steps from source)
- Initial access via trusted contact abuse: Attackers hijack legitimate Telegram accounts of individuals in the cryptocurrency space — contacts the target has met in real life. The hijacked account sends the target a Calendly meeting link via Telegram.
- Redirect to typosquatted videoconferencing domain: The Calendly link takes the victim to what appears to be a Zoom meeting URL but is actually a fake domain impersonating the videoconferencing service. A Microsoft Teams variant also exists; it is assessed as more polished, supporting emoji reactions, mobile/tablet blocking, and advanced wallet probes.
- Webcam permission capture: The phishing page prompts the victim to enter their name and grant webcam access permissions. Once granted, the webcam stream is stealthily exfiltrated to the operators' panel via mediasoup WebRTC.
- Cryptocurrency wallet fingerprinting: The kit executes a browser fingerprinting step to inventory cryptocurrency wallet extensions installed in the victim's browser. This enables selective targeting of high-value victims before malware delivery.
- Fake meeting staging: The victim enters a fake meeting showing only themselves with a "waiting for other participants" message. The operator controls the meeting from their panel, sends fake "your mic isn't working" messages, and triggers a "Zoom SDK Update" prompt.
- Deepfake video injection: The video the victim sees is not a live stream but a pre-edited composite using AI-generated headshots created with OpenAI ChatGPT, superimposed over authentic body movements captured from previous victim meetings. Each successful attack feeds source material into composites used against the next target, making the fake meeting show a plausibly familiar-looking face.
- ClickFix payload delivery: The operator triggers the "Zoom SDK Update," which results in a ClickFix-style payload — the victim is deceived into running malicious commands under the pretext of resolving camera or audio issues. The attack chain is compatible with both Windows and macOS.
- Telegram session theft and propagation: Every victim who runs the payload with Telegram Web open or Telegram Desktop installed is a candidate for Telegram session theft. The stolen session is reused to message the victim's own contacts, creating a self-sustaining attack chain.
Technical specifics from source
- Webcam exfiltration protocol: mediasoup WebRTC (real-time streaming to operator panel)
- AI tooling: OpenAI ChatGPT for headshot generation
- Lure variants: Two distinct variants captured — one for Zoom, one for Microsoft Teams
- Teams variant capabilities: Emoji reactions, mobile/tablet blocking, advanced wallet probes
- OS compatibility: Windows and macOS ClickFix chains
- Distribution platform: Telegram (hijacked accounts) → Calendly → typosquatted domain
- Campaign tracking: Activity documented since early 2025; Sekoia tracks a related cluster as "ClickFake Interview"
Confidence caveat: The full kill-chain description, wallet-profiling mechanism, deepfake composite pipeline, and ClickFix payload details are single-sourced to the JUMPSEC report. The Windows kill-chain specifics were truncated in the available source material ("The ClickFix command runs a Po..."), preventing full reconstruction of the Windows execution chain. No specific CVEs, file paths, registry keys, or malware family names were provided in the source material.
4. Mitigation & containment
P1 — Within 24 hours
- Alert security operations and threat hunting teams to the BlueNoroff Zoom/Teams phishing kit campaign; brief front-desk, executive assistants, and employees in crypto-adjacent roles.
- Block known typosquatted Zoom and Microsoft Teams domains at web gateway / DNS filtering layers. (No specific domains provided in source; enumerate typosquats of
zoom.us,zoom.com,teams.microsoft.comproactively.) - Monitor for outbound mediasoup WebRTC connections from employee workstations that did not originate from a legitimate videoconferencing client.
- Review active Telegram Web and Telegram Desktop sessions for employees in targeted roles; force session revocation where anomalous activity is suspected.
P2 — Within 72 hours
- Implement EDR detection rules for ClickFix-style execution patterns: PowerShell/cmd commands masquerading as "Zoom SDK Update" or audio/camera troubleshooting steps (see §6 for detection guidance).
- Deploy browser-extension inventory controls: enumerate and restrict unauthorized cryptocurrency wallet browser extensions on corporate-managed endpoints.
- Update phishing awareness training with specific scenarios: trusted Telegram contacts sending Calendly links → fake Zoom/Teams meetings; "mic isn't working" → run-this-command prompts.
- Review Calendly and similar scheduling-tool usage policies; consider blocking external Calendly links from untrusted senders.
P3 — Within 7 days
- Conduct a retrospective review of Telegram-based external communications involving employees in cryptocurrency, treasury, or digital asset roles since Q1 2025 (campaign documented since early 2025).
- Implement network-level controls to detect and alert on unauthorized WebRTC sessions to non-corporate endpoints.
- Engage tabletop exercise scenario: trusted-contact Telegram account compromise → Calendly lure → fake meeting → ClickFix execution → session theft propagation. Validate containment includes Telegram session revocation, browser isolation, and EDR isolation.
- Assess whether any employee webcam footage has been captured by unknown external endpoints (indicator of prior victimisation and future deepfake composite use).
5. Indicators of compromise
No atomic indicators of compromise (domains, IPs, hashes, file paths) are available in the source material. The source describes observable behaviours but no machine-pivotable artefacts.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Outbound WebRTC (mediasoup) sessions from workstation browsers to non-corporate endpoints | Network firewall / proxy logs, EDR network telemetry | High (single-sourced: JUMPSEC) |
| Browser fingerprinting of cryptocurrency wallet extensions | EDR browser process monitoring, browser extension logs | Medium (single-sourced: JUMPSEC) |
| Telegram session tokens exfiltrated from Telegram Web or Telegram Desktop | EDR file access monitoring on Telegram session data, network exfiltration alerts | High (single-sourced: JUMPSEC) |
| Calendly links received via Telegram from trusted contacts redirecting to typosquatted Zoom/Teams domains | Web gateway logs, DNS logs, proxy logs | High (single-sourced: JUMPSEC) |
| "Zoom SDK Update" prompt leading to command execution | EDR process creation logs, browser console logs | Medium (single-sourced: JUMPSEC) |
| AI-generated headshot video composites in meeting interfaces | Endpoint screen capture, user reporting | Medium (single-sourced: JUMPSEC) |
6. Detection
Insufficient indicators to author detection rules. The source material describes behaviours and tool names (mediasoup WebRTC, OpenAI ChatGPT, Telegram, Calendly, Zoom SDK Update) but does not provide specific file hashes, distinctive file strings, command-line artefacts, mutex names, scheduled task names, registry keys, or network indicators that would constitute threat artefacts suitable for YARA or Sigma rules. The tool and platform names listed are legitimate software and are not themselves indicators of malicious activity.
Recommended detection approach based on available behavioural indicators
- Sigma (conceptual): Monitor for browser child-process spawning PowerShell/cmd.exe shortly after a browser navigates to a domain containing "zoom" or "teams" typosquats, combined with "SDK" in the command line or script content.
- Network detection: Alert on outbound WebRTC/STUN/TURN sessions from corporate endpoints to non-corporate IP ranges, particularly concurrent with browser sessions to newly-registered domains.
- EDR detection: Monitor for access to Telegram Desktop session files (
tdata/) by non-Telegram processes, indicating potential session-token theft.
These approaches should be validated against your environment before deployment; they are derived from behavioural descriptions, not confirmed artefacts.
Threat actor context
APT38 · G0082 · aka NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. …
7. Sources
- The Hacker News, "BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery," https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html, 2026-07-24
- JUMPSEC (report shared with The Hacker News), detailed technical analysis of BlueNoroff phishing kit — primary technical source for attack chain, wallet profiling, and deepfake composite pipeline
- Sekoia, tracking of "ClickFake Interview" North Korea-aligned threat cluster — related campaign documentation since early 2025
8. Adverse Trace position
This is a high-severity social-engineering campaign targeting cryptocurrency-adjacent organisations, attributed to BlueNoroff (MITRE G0082) with confirmed North Korean state-nexus alignment. The self-propagating Telegram session-theft mechanism, combined with AI-generated deepfake composites that improve with each victim, makes this campaign unusually effective at bypassing trust verification — the face in the fake meeting may be recognisable to the target. EMEA financial services clients with digital asset, cryptocurrency custody, or blockchain-adjacent operations should treat this as an active, targeted threat and prioritise P1 containment actions immediately. The absence of atomic IOCs in the source material limits automated detection; behavioural detection and user awareness are the primary defensive levers until JUMPSEC releases indicators or the full report is obtained. Adverse Trace will update this advisory if the full JUMPSEC report, specific IOCs, or the truncated Windows kill-chain details become available. Confidence caveat: All technical detail in this advisory is single-sourced to the JUMPSEC report as reported by The Hacker News; verify before enforcement.
Published via PulseTrace — Adverse Trace threat intelligence.