North Korea-Linked Actors Allegedly Use AI Executive Deepfakes in Zoom Phishing Targeting Web3 Employee

A North Korea-linked cybercriminal group called BlueNoroff, part of the Lazarus Group, conducted a sophisticated cyber attack targeting a Web3 industry employee. The attack began with a Telegram message requesting a meeting and a legitimate-appearing Calendly invite that redirected to a malicious Zoom lookalike site. Weeks later, the employee joined a fake Zoom meeting populated by AI-generated deepfakes of their own company executives. When the victim reported audio issues, attackers shared a malicious 'Zoom extension' via Telegram that was actually an AppleScript triggering a stealth malware chain. The script downloaded additional payloads from fake Zoom domains, including a backdoor disguised as a support tool. Security researchers found eight unique malware components on the infected Mac, including a keylogger that captured clipboard and screen data, and CryptoBot which hunted for and exfiltrated cryptocurrency wallet data. All traffic was routed through command and control infrastructure mimicking Zoom domains. BlueNoroff is known for financially motivated attacks and has been responsible for previous major breaches including the Axie Infinity hack in 2022 and the Bybit breach in 2025.