BlueNoroff: a Zoom kit tailored for crypto, with live AI deepfake video
The North Korean group BlueNoroff (Lazarus) has been operating a Zoom/Teams phishing kit since May 2026 that compromises legitimate Telegram accounts, invites targets to a fake meeting, captures their webcam, overlays an AI deepfake (ChatGPT), profiles installed crypto wallets, and then pushes malware via ClickFix. Five versions of the kit documented by JUMPSEC.
Jul 24, 2026 8 2


