North Korean hackers target crypto users via fake Zoom meetings

The North Korean hacker group BlueNoroff has deployed a new attack method to target crypto professionals. Through fake meetings in Zoom and Microsoft Teams, the attackers attempt to deceive victims and install malware that steals sensitive data, including browser wallets and Telegram sessions.

Hijacked Telegram accounts as an entry point

Cybersecurity firm JUMPSEC has linked the attacks to BlueNoroff, a group known for targeting the crypto sector. The tactic begins with hijacked Telegram accounts, through which the attackers send malicious links to unsuspecting crypto professionals. Those links lead to fake meetings that appear to be legitimate Zoom or Microsoft Teams sessions.

Before the malware is actually delivered, the system first scans the victim’s browser wallets. In this way, the attackers profile their targets and determine whether it is worth proceeding with the attack. This makes the method particularly targeted and dangerous for anyone active in the crypto sector, reports The Hacker News.

Fake SDK update installs malware on Windows and macOS

Once the victim falls into the trap, they are asked to install a so-called SDK update. This file initially looks legitimate, but is in fact malware that works on both Windows and macOS. Once active, the software can extract a wide range of sensitive information.

This includes system data, browser keys and active Telegram sessions. For crypto users, this is especially dangerous because attackers can use stolen browser keys to gain direct access to digital wallets. This type of attack once again shows how sophisticated and targeted state-linked hacker groups operate. Earlier, the crypto payment service Triple-A was also hacked, resulting in the theft of millions of dollars. Anyone working in the crypto sector would be wise to approach unexpected meeting invitations via Telegram with the necessary scepticism and never install software through an external link.