The North Korean hacking group BlueNoroff is using fake Zoom and Teams meetings to scan for crypto wallets and deploy malware

Svmuu News: The North Korean hacking group BlueNoroff is using fake Zoom and Microsoft Teams meetings to target cryptocurrency users and deploy malware. The group first takes control of the accounts of contacts in the crypto industry whom the victims trust, then sends seemingly legitimate meeting links via platforms like Calendly that redirect to fake Zoom and Teams domains. Once users access the fake meeting page, the page scans for wallets in their browser and decides whether to proceed with the attack based on the wallet’s value. The fake meetings also prompt users to “update Zoom/Teams” or run commands, which actually download malware compatible with Windows and macOS.