'The attacker completed in under five minutes': Experts warn of North Korea-linked campaign using fake Zoom meetings to target crypto execs
North Korean state-sponsored hackers linked to the Lazarus Group, specifically the BlueNoroff subgroup, are targeting cryptocurrency executives through highly convincing fake Zoom meetings. The attackers use AI-generated videos and cloned websites to trick victims into installing malware via a clipboard hijacking technique. This allows rapid system compromise, credential theft, and persistent access, with full infiltration completed in under five minutes. The campaign reflects a sophisticated, financially motivated cyber-espionage effort against Web3 and crypto firms.
- ▪The attack is carried out by BlueNoroff, a financially motivated arm of North Korea's Lazarus Group.
- ▪Fake Zoom meetings use AI-generated headshots and semi-animated videos to impersonate real industry figures.
- ▪A malicious JavaScript on the fake Zoom site hijacks clipboard data, replacing benign commands with malware-deploying code.
- ▪The entire attack chain, from initial click to full system compromise, takes less than five minutes.
- ▪The goal is to steal credentials, session tokens, and cryptocurrency assets from targeted organizations.
Opening excerpt (first ~120 words) tap to expand
Pro Security 'The attacker completed in under five minutes': Experts warn of North Korea-linked campaign using fake Zoom meetings to target crypto execs News By Sead Fadilpašić published 28 April 2026 A highly sophisticated scam will leave you questioning what's real When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. (Image credit: Shutterstock) Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter State-sponsored attackers crafted convincing fake video calls to target cryptocurrency firmsA clipboard hijack trick replaced benign commands with malware‑deploying codeThe operation enabled rapid…
Excerpt limited to ~120 words for fair-use compliance. The full article is at TechRadar.
Discussion
0 commentsMore from TechRadar
