Adversary Intelligence — 2026-05-02

BlueNoroff Uses Fake Zoom Calls to Turn Victims Into Attack Lures

The North Korea-linked BlueNoroff group is deploying typo-squatted Zoom and Teams domains with ClickFix clipboard injection to compromise financial and cryptocurrency sector employees, then weaponizing victims as lures for further attacks, according to an Arctic Wolf technical report published April 27. Arctic Wolf identified over 80 typo-squatted meeting domains registered between late 2025 and March 2026 and attributed the campaign with high confidence to BlueNoroff. Analysis of over 950 files from the attacker's media hosting server revealed a self-reinforcing deepfake pipeline in which exfiltrated webcam footage from prior victims was combined with AI-generated images to produce convincing fake meeting content for subsequent operations. Eighty percent of identified targets operate in cryptocurrency or blockchain finance, with CEOs and founders accounting for 45 percent of the target set.

Analysis
Weaponizing compromised individuals as lures, routing AI-deepfaked meeting content through prior victims to extend trust chains into secondary targets, amplifies threat surface in a way cold spear-phishing cannot. Per a single Arctic Wolf technical report (moderate confidence in tradecraft specifics), ClickFix clipboard injection paired with typo-squatted meeting domains achieves initial access without attachments that endpoint tooling flags. Capability overlaps across the broader Lazarus ecosystem leave open whether this is a BlueNoroff-specific shift or shared infrastructure. BlueNoroff is likely to be publicly attributed to at least one additional social-engineering campaign leveraging legitimate platforms within the next 90 days.
4 sources
  1. BlueNoroff Uses Fake Zoom Calls to Turn Victims Into Attack Lures - Dark Reading
  2. Crypto-Targeting North Koreans Wield Fake Zoom Meetings - BankInfoSecurity
  3. North Korean Hackers Target Crypto Firms with ClickFix and Zoom Lures - Infosecurity Magazine
  4. BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector - Arctic Wolf

View in full brief →

UNCLASSIFIED // OPEN SOURCE