BlueNoroff uses AI deepfake executives in Zoom phishing targeting Web3 worker
North Korea-linked BlueNoroff group conducted a sophisticated phishing attack on a Web3 employee using AI-generated deepfakes of company executives in fake Zoom meetings combined with macOS malware. The attack deployed multiple malware components including keyloggers, screen capture tools, and cryptocurrency wallet stealers.
What happened
BlueNoroff, a North Korea-linked group, targeted a Web3 industry employee through a multi-stage attack beginning with a Telegram message requesting a meeting. A Calendly invite redirected to a malicious Zoom lookalike site.
The employee joined a fake Zoom meeting where AI-generated deepfakes of their own company's executives were displayed. When the employee reported audio issues, attackers sent a malicious 'Zoom extension' via Telegram that deployed a stealth malware chain.
Reported impact
The malware deployed eight unique components including a keylogger, clipboard and screen capture tool, crypto wallet stealer, and backdoor disguised as a support tool. The malware bypassed user logs and prompted for system password entry to install additional payloads.
Index analysis
The attack reflects growing sophistication in nation-state phishing operations, combining deepfake video technology with social engineering and multi-stage malware deployment. BlueNoroff, also tracked as APT38 and TA444, is part of the North Korean Lazarus Group and known for financially motivated attacks including the Axie Infinity hack (2022) and Bybit breach (2025).
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.