Ledger / Jun 2025
BlueNoroff uses deepfaked executives in Zoom call to infect crypto employee
Strong
Huntress incident analysis reports deepfaked leadership on the call; deepfake evidence is the victim account.
A Telegram and Calendly lure led to a fake Zoom with deepfakes of known leaders who told the victim to install an extension, which was a malicious AppleScript. Huntress investigated in June 2025.
“North Korean hackers deepfake execs in Zoom call to spread Mac malware”BleepingComputer
Sources
- North Korean hackers deepfake execs in Zoom call to spread Mac malwareBleepingComputer · 26 Jun 2025 · secondary source
- Inside BlueNoroff Web3 intrusion analysisHuntress · 26 Jun 2025 · primary source
- Date
- Jun 2025
- Actor
- BlueNoroff / TA444 / Sapphire Sleet (Huntress: STARDUST CHOLLIMA) (nation state), as attributed by BleepingComputer
- Nexus
- North Korea
- Targets
- Cryptocurrency foundation employee (macOS)
- What the AI did
- Deepfake, Social engineering
- Model
- unspecified voice-clone/deepfake tool
- Model family
- Deepfake / voice
- Model basis
- stated by researcher
- Autonomy
- assist
- Outcome
- Eight malicious binaries installed including keylogger and wallet hijacker.