BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet

The article reports that BlueNoroff is using an actively developed phishing kit to impersonate Zoom and Microsoft Teams, profile victims’ cryptocurrency wallets, and then deliver malware after social engineering succeeds. It also describes a broader campaign pattern combining typosquatted meeting domains, wallet reconnaissance, and trust abuse to target high-value crypto victims. From a RealGround perspective, this is best treated as malicious AI-enabled social engineering risk, with priority on detection of fake meeting flows, user verification controls, and red-teaming against deepfake- and phishing-assisted intrusion paths.