Threat Actor
John (@alchemy_john_mac)
- First Reported
- Jul 24, 2026
- Latest Reported
- Jul 24, 2026
Reported Context (1)
- JUMPSEC linked the stealer's hard-coded Telegram bot token to an operator using this name and handle; the source reports the attribution and notes the individual was observed asking cryptocurrency-group administrators about vesting contracts and withdrawing funds. BlueNoroff Uses Fake Zoom and Teams Meetings to Profile Crypto Wallets and Deliver Malware
People (1)
Threat Actors (2)
MITRE ATT&CK (14)
Products (9)
Industries (2)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.