BlueNoroff Uses Fake Zoom and Teams Meetings to Profile Crypto Wallets and Deliver Malware
Summary
JUMPSEC says BlueNoroff’s Zoom and Teams phishing kit abuses trusted Telegram contacts, profiles browser wallet extensions, and uses fake meetings and ClickFix lures to deliver Windows and macOS malware. Researchers found five kit versions from May to July 2026.
Key points
- JUMPSEC says attackers use hijacked Telegram accounts and fake Calendly meeting links to reach trusted contacts and target employees in the cryptocurrency industry.
- Fake Zoom and Teams pages can capture webcam streams and stage a meeting before prompting victims to run a ClickFix payload.
- The kit inventories browser extensions to identify cryptocurrency wallets and checks browser profiles for Telegram Web-related files.
- On Windows, a PowerShell loader runs a VBScript that disables Microsoft Defender and checks for Telegram-related files; the article says the next-stage payloads are unknown.
- On macOS, a fake Teams or Zoom installer runs a stealer that exfiltrates system metadata and Chrome master keys from iCloud Keychain via Telegram.
- JUMPSEC identified five phishing-kit versions dated May 31 to July 14, 2026, which it says indicates ongoing development.
- Researchers reported that the macOS stealer’s Telegram bot token and chat ID led them to an operator using the name “John”; the attribution is presented as their finding.
Article Details
- Attack Vectors
- Attackers use compromised Telegram accounts and trusted contacts to send Calendly meeting links that lead to fake Zoom or Microsoft Teams pages.
- The phishing pages request the victim's name and webcam permissions, then show a staged meeting and use fake microphone-error messages and a purported SDK update to prompt ClickFix-style command execution.
- The kit inventories browser extensions to identify cryptocurrency wallet users, including MetaMask users, and checks browser profiles for Telegram Web-related files.
- On Windows, the ClickFix command runs a PowerShell loader that downloads and executes a VBScript implant; the implant can deliver additional payloads.
- On macOS, the ClickFix command runs a shell script that downloads a fake Teams or Zoom installer. The installer runs a stealer that collects system metadata and Chrome master keys from iCloud Keychain and sends data to a Telegram channel.
- The phishing kit sends webcam video to the operators' panel using mediasoup WebRTC and uses pre-edited video featuring AI-generated faces over previously captured body movements.
- Defensive Notes
- JUMPSEC advises treating identity, relationships, and communication channels as critical parts of an organization's security posture.
- The article describes compromised trusted contacts, reusable Telegram sessions, and wallet-extension reconnaissance as parts of the campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | us[.]zoom[.]06webin[.]us | Example of a typosquatted fake Zoom domain used in the phishing kit's lure scheme. |
MITRE ATT&CK
T1059.001 · PowerShellOn Windows, the ClickFix command runs a PowerShell loader.T1059.004 · Unix ShellOn macOS, the ClickFix command runs a shell script to download a fake meeting-platform installer.T1059.005 · Visual BasicThe Windows loader downloads and executes a VBScript implant.T1082 · System Information DiscoveryThe macOS stealer collects system metadata.T1105 · Ingress Tool TransferThe Windows loader downloads a VBScript, and the macOS shell script downloads a fake Teams or Zoom installer.T1125 · Video CaptureThe phishing page obtains webcam access and streams video to the operators' panel.T1204.004 · Malicious Copy and PasteThe ClickFix lure prompts victims to run a malicious command under the pretext of fixing meeting audio or installing an SDK update.T1518 · Software DiscoveryThe Windows implant enumerates browser extensions and matches extension IDs against cryptocurrency wallet extensions.T1539 · Steal Web Session CookieThe campaign seeks to steal Telegram session cookies from victims using Telegram Web or Telegram Desktop.T1550.004 · Web Session CookieThe article says stolen Telegram sessions are reused to message the victim's contacts.T1555.001 · KeychainThe macOS stealer extracts Google Chrome master keys from iCloud Keychain.T1562.001 · Disable or Modify ToolsThe Windows script disables Microsoft Defender and adds the C:Users folder to its exclusion path.T1566.002 · Spearphishing LinkCompromised Telegram contacts send Calendly links that lead victims to fake Zoom or Teams meeting pages.T1567 · Exfiltration Over Web ServiceThe macOS stealer exfiltrates collected data to the attackers via a Telegram channel.
People
Threat Actors
BlueNoroffThe article attributes the phishing kit and related malware-delivery campaign to BlueNoroff operators, who use compromised Telegram accounts, fake meeting pages, wallet reconnaissance, and Windows and macOS payloads.ClickFake InterviewSekoia tracks ClickFake Interview as a related North Korea-aligned threat cluster using ClickFix-like lures to trick targets into running malicious commands.John (@alchemy_john_mac)JUMPSEC linked the stealer's hard-coded Telegram bot token to an operator using this name and handle; the source reports the attribution and notes the individual was observed asking cryptocurrency-group administrators about vesting contracts and withdrawing funds.
Products
Calendly#BlueNoroffGoogle ChromeThe VBScript implant checks for the presence of Telegram Web-related files within Google Chrome, Microsoft Edge, Brave, and Mozilla Firefox profile directories, likely to determine if the victim has an active TelegrammacOSWindows and macOS payloads deliver loaders, stealers, and defense evasion steps.MetaMask#BlueNoroffMicrosoft Defender Antimalware PlatformThe ClickFix command runs a PowerShell loader that downloads and executes a VBScript, disables Microsoft Defender, adds “C:Users” folder to the exclusion path, and force-restarts Defender so that the exclusions areMicrosoft TeamsNorth Korean-linked BlueNoroff operators are using typosquatted Zoom and Microsoft Teams domains, stolen Telegram accounts, and fake videoconferencing lures to deliver malware through a repeatable social-engineeringMicrosoft WindowsWindows and macOS payloads deliver loaders, stealers, and defense evasion steps.TelegramNorth Korean-linked BlueNoroff operators are using typosquatted Zoom and Microsoft Teams domains, stolen Telegram accounts, and fake videoconferencing lures to deliver malware through a repeatable social-engineeringZoomNorth Korean-linked BlueNoroff operators are using typosquatted Zoom and Microsoft Teams domains, stolen Telegram accounts, and fake videoconferencing lures to deliver malware through a repeatable social-engineering
Countries
Industries
CryptocurrencyThe phishing kit fingerprints victims’ browsers for cryptocurrency wallets, steals sessions, and uses AI-generated faces and edited video to make fake meetings look convincing.financeZoom and Teams are the default for a lot of crypto/venture capitalist/founders in the finance world – whereas Google Meet feels more of a customer calling platform rather than an “investor/partnership call.”