BlueNoroff Orchestrates Attacks via Fake Video Conferences: AI Deepfakes and Wallet Theft in the Crosshairs

Introduction

On July 24, 2026, researchers at JUMPSEC uncovered a dangerous campaign orchestrated by the North Korean group BlueNoroff, known for its targeted attacks on the cryptocurrency sector. The threat exploits counterfeit invitations to Zoom or Microsoft Teams meetings, distributed via stolen Telegram sessions and Calendly links, to deceive high-profile victims. The operation combines advanced social engineering, AI-generated deepfake videos, and a self-propagation mechanism: once a Telegram account is compromised, the attacker sends the bait to trusted contacts, widening the scope. The ultimate goal is to locate cryptocurrency wallets (such as MetaMask) and steal funds using malware loaded via ClickFix commands.

Technical Analysis

The attack begins with a Telegram message from an already compromised contact, containing a link to a Calendly page that schedules a video call appointment. The link leads to a fake waiting portal that mimics the Zoom or Microsoft Teams interface. Here, the victim is prompted to grant webcam access: the video stream is routed to the operators via the mediasoup WebRTC framework, while a script catalogs the wallets installed in the browser (MetaMask and others) through extension fingerprinting.

During the fake meeting, the victim sees a prerecorded video with a face generated by OpenAI ChatGPT, animated based on real movements captured from previous targets. After a few moments, an error message appears indicating a “non-functioning microphone,” prompting the victim to execute a series of ClickFix commands – typically a PowerShell script on Windows or a shell script on macOS – to “resolve the issue.”

Windows chain: PowerShell downloads a VBScript that disables Microsoft Defender, adds exclusion paths, and steals Telegram sessions from Chrome, Edge, Brave, Firefox, Opera, and Vivaldi. It then sends the wallet extension IDs to the command server, allowing attackers to select only users with high-value wallets.

macOS chain: A shell script downloads a fake installer; once executed, an info-stealer exfiltrates iCloud Keychain keys, system metadata, and sensitive data stored in Chrome via Telegram (channel “Aurora”).

The infrastructure abuses typosquatted domains similar to the originals (e.g., zoom.us, teams.microsoft.com) and relies on legitimate services like Telegram and Calendly to make filtering more difficult. Researchers at Sekoia have linked this activity to the “ClickFake Interview” cluster, while the operational signature of the actor “John” (@alchemy_john_mac) was spotted in May 2026 in smart contract discussion groups.

Impact

The severity is high for several reasons:

• Self-propagation: Stolen Telegram sessions are used to send additional baits to the victim's contacts, creating a difficult-to-stop cycle of compromise.
• Targeted theft: The pre-selection based on installed wallets allows hitting only targets with digital assets, maximizing financial gain.
• Multi-dimensional exfiltration: Beyond wallets, credentials, metadata, browser history, and on macOS, iCloud Keychain keys are stolen.
• Defense weakening: Disabling Microsoft Defender and adding exclusion paths ensure persistence and facilitate the loading of additional payloads.

Mitigation

Currently, no official countermeasures exist, but from the modus operandi, some essential practices can be deduced:

• Dual-channel verification: If you receive a video conference invitation from a known contact, reach out to them via another method (phone, email) before clicking the link.
• Limited permissions: Never grant webcam or microphone access to sites you do not absolutely trust, especially when accessed via chat links.
• No “copy and paste” commands: Beware of instructions that invite you to run PowerShell code or terminal commands to fix technical issues during a call.
• Protect Telegram: Enable two-factor authentication and, if possible, isolate wallet extensions in a separate browser profile, without saving messaging sessions.
• Endpoint monitoring: Keep an eye out for suspicious VBScript/shell executions, changes to Windows Defender settings, and connections to newly registered or typosquatted domains.

FAQ

1. How can I recognize a malicious video conference invitation?
Signs include links received suddenly from Telegram contacts, especially if followed by messages like “we need to discuss an investment.” Always check the URL: domains with slight variations (e.g., “zoomus” instead of “zoom.us”) are a red flag. If in doubt, contact the sender via an alternate channel.

2. Why do attackers ask for webcam access?
For two reasons: the victim's video is streamed in real-time to the operators, who store it and reuse it to create deepfakes later shown to other victims. Additionally, the permission allows the site to activate scripts that profile wallets directly from the browser.

3. What happens if I run the proposed ClickFix commands?
Malware is downloaded and launched that disables Microsoft Defender (on Windows) or runs an info-stealer (on macOS). From that point, the attacker can steal Telegram sessions, wallet keys, and personal data, and use the account to propagate the attack to your contacts. If you have executed these commands, immediately disconnect the computer from the network, change passwords from a clean device, and contact a security expert.